We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [c]

General purpose programming language that uses the procedural and structured programming paradigm.

Filter by
Sorted by
Tagged with
1
vote
1answer
213 views

Injecting exe file into process fails on windows 7 but works on windows 10 / Execution library function fails, access denied

I'm trying to inject my executable payload into remote process. I allocated memory in remote process, I converted raw payload using RVA addressing. I applied relocations and imports table. When I'm ...
0
votes
1answer
44 views

How to protect memory area, not segment or page!

I want to protect the certain memory area, like 0x12345678 ~ 0x12345679. so if another thread accesses to that area, I want to generate exception. To solve my problem, I've found and used ...
1
vote
1answer
67 views

Generate this assembly from a c program

I want to generate this assembly code: mov ecx, <absolute address of func1> call ecx How can I write and compile C code which generates this code?
3
votes
1answer
2k views

Understanding Program Arguments on the Stack in Assembly

To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
0
votes
1answer
213 views

Translating ida macros and pseudocode into C++/C

What would be the translated C output of this hexrays decompiler pseudocode? The values of v6 and v5 are floats just as v8. The value of xmmword_108365D0 is 7FFFFFFF7FFFFFFF7FFFFFFF7FFFFFFFh v8 = (...
4
votes
1answer
303 views

How do I find out what section variables and strings are defined in?

Given a simple program like this, void main (int argc, char * argv[] ) { char * arr[] = {"foo", "bar", "baz"}; *(arr[0]) = 'F'; printf( "%s", arr[0] ); } How do I find out what section ...
3
votes
1answer
138 views

Basic hello world stack manipulation troubles

I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers". Here is the hello world program from the book (taken from chapter 3, page 12) : Now ...
1
vote
1answer
403 views

Reading from text file and printing it in IDA Pro

I have a text.txt file and I want to read it and print its content in the Output Window of IDA Pro (Free version). I wrote an .idc script as follows: #include <idc.idc> static main() { ...
2
votes
3answers
874 views

Android- hiding private keys in .so file

I am working on an application where we need to encrypt certain assets at compile time in Gradle. We then need to decrypt them with the same private key, so we are using a symmetric key system but we ...
2
votes
2answers
541 views

ASM code hook/patching with trampoline function

I am stuck on making (my little self-task for learning) that thing: Basically it should be something like Themida or VMProtect (do mutation, virtualization, etc.), but in my case, i want to take ASM ...
1
vote
2answers
121 views

How can I deal with exception handler in Visual C/C++ inline assembly?

I have disassembled a function in IDA Pro and I want to compile it into my project in visual c inline assembly... I'm still a newbie, so let me apologize if I don't use the right terminology...(I'm ...
1
vote
1answer
357 views

Capstone: What's the purpose of the 'address' argument in cs_disasm()?

I'm trying to play around with the Capstone Disassembler in C. In the documentation they show the following use of the cs_disasm() function: from here count = cs_disasm(handle, CODE, sizeof(CODE)-1, ...
1
vote
5answers
289 views

C representation of simple assembly

I have the following very simple X86 assembly: shr cx, 1 jae short <addr> So basically, the jump will be taken if the Carry flag is not set. In the case of shr, CF will be set to the value of ...
0
votes
1answer
430 views

Patching branch on assembly code

I compile this code 1. #include <stdio.h> 2. void F(int a, int b) 3. { 4. int c= a+b; 5. int d= a*b; 6. } 7. void printAll() 8. { 9. printf("test1"); 10. printf("test2"); 11. ...
0
votes
2answers
617 views

explain c compile code

I compile c code to arm with this site https://godbolt.org/ int F(int a, int b) { int c=0; for(int i=0;i<=10;i++) { c+=a+b; } return c; } the result was F(int, ...
-1
votes
1answer
680 views

help needed to understand this pseudo code from ida and possibly recreate it

I've be on with the application for a while now and have pinpointed some interested functions, I would like to be able to implement them in to another application but I'm not sure how to get them "out"...
1
vote
1answer
247 views

Odd convention for accessing elements of an array?

While reverse engineering a game using the Hex Rays decompiler I was looking for how an array of NPC's was accessed. I found the array but I don't quite understand the unusual formula for getting the ...
3
votes
2answers
373 views

how to find the encryption algorithm?

I have an arm complied so file and find the decrypt function which pseudocode generated by IDA Pro is like this: char __cdecl EncodeUtil::getDecryptStr() { int *v0; // r0 int *v1; // r7 ...
1
vote
1answer
337 views

re-construction of c code: movsx with test instruction

I just started learning about reconstructing C code from assembler instructions. I have the following piece of assembler code: mov eax dword ptr [ebp+8] add eax, dword ptr[ebp-4] movsx ecx, byte ptr ...
1
vote
0answers
73 views

Decompiled code calls a function with unitialized variables

I'm working on decompiling the scripting engine from the game Rayman 2. It's going pretty well, but I'm getting stuck on a particular function which calls another function with arguments that aren't ...
2
votes
1answer
939 views

How can I see the heap data in ollydbg?

I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc(). I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
1
vote
0answers
48 views

Is there a static address to a pointer on Mac OS?

Given the sample code below: #include <iostream> struct Data { int a; int b; int c; }; int main() { Data *d = new Data; d->a = 1337; d->b = 1338; d->c = ...
1
vote
1answer
1k views

What does this assembly instruction do?

push %rbp mov %rsp,%rbp mov %rdi,-0x18(%rbp) mov %rsi,-0x20(%rbp) mov -0x18(%rbp),%rax mov (%rax),%eax mov %eax,-0x4(%rbp) mov -0x20(%rbp),%rax mov (%rax),%edx mov -0x18(%...
0
votes
1answer
239 views

TOKEN structure in Kernel

I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code. ...
1
vote
0answers
689 views

How to decrypt .jpg files of comics app in a C Program?

I'm trying to decrypt jpg images of comics I purchased in my comic reader app on android but neither I can view them (after copying from SD card to Windows desktop) nor can I convert them to pdf to ...
1
vote
1answer
1k views

How can I convert a .bin file to either assembly or C?

I have a .bin file (It's a firmware belongs to a hardware (Cisco Access-Point) ). All I need to do is modifying that .bin file. As you know, .bin files aren't human readable. I need to convert it to ...
4
votes
2answers
1k views

How do I approach this CTF Debugging Program?

I have an ELF executable I'm working on (got it from a previous CTF competition). The executable simply asks for a password, and then it prints out "congrats". The code snippets and my annotations ...
1
vote
1answer
139 views

Unknown comparison

I'm trying to decompile some singleplayer code for a game (C++ on X86 architecture Linux). I do this with the help of some already available source code, a file (compiled on linux) with debug ...
0
votes
1answer
117 views

IDA: Two calls of a same function

I was reversing some executable and came across to this code: As I found out later, it's using function pointer to call function sub_4011C0 and that could be the reason. My question is why does ...
1
vote
2answers
563 views

Understanding an if statement in assembly

I have written two simple C programs (one with an if and one without). Looking at the assembly differences there are a few lines that I can't manage to explain and was hoping to get some assistance. ...
2
votes
3answers
444 views

Exports that redirects to other library

I'm writing an analog of GetProcAddress function. When looking inside the export table I see the exports like this in advapi32.dll for example: .text:4C362BAA aEventregister db 'EventRegister',0 ;...
4
votes
2answers
389 views

Inverse And operation

I'm trying to write a keygen to a crack me that I'm learning from and I got stuck. What happens there is pretty simple: Let's say that I entered the password: "12121212" XOR DWORD PTR DS:[ECX+EAX],...
1
vote
1answer
864 views

Calling Swift 4 methods from C

I have earlier been able to call Swift methods using a function pointer from C, and providing the appropriate arguments because the calling convention was the same. Unfortunately this no longer works....
1
vote
2answers
719 views

IDA Pro - Applying function signatures

I have three files: ELF executable, ELF dynamically linked library (.so), C headers file (.h) with function signatures and related structures for that library. #1 imports a number of functions from #...
4
votes
2answers
171 views

What's the best way of improving already compiled binary?

Like if I want to patch a function in a PE. Now my way of doing this would be inserting a new section using lets say LordPE and then compiling anything I want to add up here and patching the original ...
1
vote
1answer
138 views

Need help reversing this loop

I am having a difficult time reversing the following loop: │ ┌─< 0x100001fea 723b jb 0x100002027 │ │ 0x100001fec 31db xor ebx, ebx ; ebx = ...
-1
votes
1answer
624 views

Aside from Assembly, should I learn C or C++?

With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most ...
2
votes
2answers
951 views

IDA pro: jump back to previous instruction

I'm new with IDA pro and currently running with debugger, I have few questions: How can I jump on previous instruction? Undo the latest instruction ? Is it possible in IDA to examine memory of an ...
1
vote
1answer
422 views

Mach-O : Convert virtual address to file offset on disk

Hello reverse engineers, I am reverse engineering a Mach-O executable for iOS. File says: Mach-O universal binary with 2 architectures: [arm_v7: Mach-O arm_v7 executable] [64-bit architecture=12]. I ...
3
votes
2answers
2k views

Changing Entrypoint in ELF executable

I wrote some code that does the following: Searches for and finds an offset in a binary file to add code (looks for a sequence of 00s I can overwrite). Then, I change the entrypoint of the ELF to ...
6
votes
2answers
10k views

Radare2 C output

I made a simple hello world program, and put it in radare2. I then ran the pc command, which displayed C output. The output was this: #define _BUFFER_SIZE 256 const uint8_t buffer[256] = { 0x55, ...
0
votes
2answers
585 views

c++ version of MOV AL,BYTE PTR DS:[ESI]

I'm writing a keygen for a crack-me exercise. I have a problem with handling byte assignments the crack-me performs several times using instructions like MOV AL,BYTE PTR DS:[ESI] (move byte from ...
0
votes
1answer
72 views

Which environmental variables can be used alter control flow and keep suid?

I am working on a challenge where it is possible to manipulate environmental variables (in C). I know that with PATH it is possible to execute arbitrary programs when relative path is used, for ...
2
votes
1answer
2k views

Basic Buffer Overflow Help

I am currently practicing for a CTF competition and one of the practice challenges is a buffer overflow exploit. Before this challenge I knew absolutely nothing about these exploits, but I've been ...
7
votes
1answer
235 views

Is there a way to find out which hash standard by studying the source code?

We have an embedded product, which we are carrying for several hardware iterations since more than 5 years ago. We have all the source code, most of it nicely documented. As the product is actively ...
-1
votes
1answer
608 views

what is best forum to ask about hex reversing? [closed]

i want to create c script extract encrypt package. just can open it in hex editor to view and need knowledge and technique for write script for extract it. Script will work in command-line ( window 10 ...
1
vote
0answers
48 views

Fighting programs that don't respond to Send/PostMessage-based input

This can be difficult to ask because 1) people assume this is necessarily malicious and 2) unrelated but effectual techniques like GetForegroundWindow can make this impossible to answer. So, to keep ...
3
votes
1answer
846 views

Identifying possible structs in C/C++ disassembly

I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler *(_DWORD *)(a2 + 16) = a2 + 624; *(_DWORD *)(...
2
votes
1answer
1k views

Finding hidden string location using radare2 on ELF binaries

I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries. I was provided these by a colleague and can be ...
1
vote
1answer
611 views

Assembly and C++

I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...