The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [c]

General purpose programming language that uses the procedural and structured programming paradigm.

Filter by
Sorted by
Tagged with
1
vote
1answer
4k views

How does scanf interact with my code in assembly

I have recently started getting into assembly for the purpose of reverse engineering. I started small with understanding basic datatypes, but I want to move on to more complex datatypes and functions. ...
1
vote
1answer
1k views

What knowledge do I need to read “The IDA Pro Book”?

I'm interested in vulnerability research and I want to get started in reading the book mentioned in the title. But the thing is that while I'm fairly confident in Python and PHP, I absolutely have no ...
0
votes
0answers
71 views

dlmalloc free pointers

I was looking at the implementation of "free" in my current dlmalloc(both the source and the disassembly). However, I could not find the code section the inserts the FD and BK into free chunks. What ...
1
vote
2answers
168 views

Globally allocated arrays optimization

I compile C code snippet with VS2010 by two ways: int g_arra[3]; int main() { int idx = 2; g_arra[0] = 10; g_arra[1] = 20; g_arra[2] = 30; g_arra[idx] = 40; return 0; } With /O2 ...
1
vote
3answers
608 views

Dump global datas to disk in assembly code

the experiment is on Linux, x86 32-bit. So suppose in my assembly program, I need to periodically (for instance every time after executing 100000 basic blocks) dump an array in .bss section from ...
-2
votes
1answer
380 views

Assembly analyze C system() function

So I made a very simple C program to study how C works on the inside. It has just 1 line in the main() excluding return 0: system("cls"); If I use ollydebugger to analyze this program It will show ...
1
vote
1answer
162 views

Declaration of a complex C expression

I used IDA Pro and got the following expression from a produced C file: v25 = (*(int (**)(void))(v22 + 464))(); I am trying to figure out the meaning of the above expression with the following links:...
2
votes
1answer
523 views

How do I find a collision for a simple hash algorithm

I have the following hash algorithm: unsigned long specialNum=0x4E67C6A7; unsigned int ch; char inputVal[]=" AAPB2GXG"; for(int i=0;i<strlen(inputVal);i++) ...
1
vote
2answers
518 views

How can I change the a port a program listens on?

I want to change the port number a program listens on. The program is a proprietary linux binary, Plex, that always listens to tcp port 32400 (hard-coded). Since I want to run this on a shared server,...
1
vote
1answer
708 views

Address of loaded driver on memory [closed]

How find address of loaded specific driver on memory by C language in windows os thanks
1
vote
1answer
323 views

How to find status and path of the specific module with C in the windows? [duplicate]

How to find status and path of the specific module with C in the windows? such as windbg lm (list loaded module) kd> lm m cdd start end module name 93ae0000 93afe000 cdd (...
1
vote
2answers
142 views

During debugging, is the process memory the same as the debugger's memory space?

This post might be specific to IDA Pro, so bear that in mind. I'm currently trying to write a plugin for debugging specifically one executable. I know that a certain object in the executable's ...
5
votes
2answers
253 views

Returning a C function to its grandfather

This is a homework assignment, so I'd appreciate it if I would get a hint only, not a full answer. I wrote this program which is supposed to print the following: Executing function_a Executing ...
2
votes
1answer
6k views

64-bit integers on 32-bit machines

Let's say I create a program in C like this and compile it on a regular 64-bit desktop machine: #include <stdint.h> int main(void) { uint64_t a = 0x12345679abcdefULL; uint64_t b = ...
3
votes
0answers
2k views

Reverse Engineering a 8 bit CRC checksum

I am trying to create a communication interface using C Language to an Air conditioning system, after analyzing the data packets I have identified that the data packet is consist of an 8 bit CRC (I am ...
2
votes
1answer
1k views

How to get the information of “how many and which symbols are resolved by linker”?

The test is on 32-bit Linux, x86. With gcc 4.6.3 and GNU ld 2.22. So I am trying to get the information of "how many symbols are resolved by linker" during link time? And how can I list the ...
3
votes
1answer
11k views

what's the function of LODWORD and HIDWORD?

I'm trying to figure out what does this piece of code exactly: LODWORD(fMax) = *(_DWORD *)v12; HIDWORD(fMax) = v13; I was reading on IDA\Plugins\defs.h the definition, but I don't understand ...
0
votes
3answers
248 views

Is it possible to programmatically search a disassembly for functions missing bounds checks?

Suppose I was to search a file for dangerous C functions: Assuming that we can perform a dissassembly, and that we cannot perform dynamic analysis is it possible to definitively identify a lack of ...
1
vote
0answers
533 views

Define new code section in assembly code to compile ELF binary

I defined a new code section in my assembly program, which is going to be compiled into 32-bit ELF binary, on x86. I use the linker scripts to assign a specified address for this new code section, it ...
1
vote
1answer
504 views

How to load library defined symbols to a specified location?

The test is on Ubuntu 12.04, 32-bit, with gcc 4.6.3. Basically I am doing some binary manipulation work on ELF binaries, and what I have to do now is to assemble a assembly program and guarantee the ...
2
votes
2answers
2k views

How can I write my main function as assembly opcodes in an integer array?

My OS is Windows 7 64-bit and my processor is an Intel Core i7-4700MQ running on the x64 architecture. My program is 32-bit. Recently, I read an article here describing how it is possible and legal ...
-1
votes
2answers
33k views

EXE to C source code decompiler [duplicate]

Is there any decompiler out there which can take a .exe file and decompile it into C code (the execution file was also written in C)? Obviously I'm not looking for a 1 to 1 results with the original ...
1
vote
3answers
706 views

Can one modify a program by “wrapping” its binary? What tools exist?

(This question is related to How do I add functionality to an existing binary executable?). I too would like to add functionality to an existing application, but I do not want to modify the original ...
8
votes
1answer
1k views

Becoming A Better Reverse Engineer

I have been looking on the net and all I see when it comes to reverse engineering are a bunch of silly crackme tutorials. I want to be better at taking code from assembly to c or c++. I am getting the ...
0
votes
1answer
919 views

Convert C/C++ function to raw bytes [closed]

I'm planning to inject a thread into another process and unfortunately I need to write the thread function in raw bytes and can't just compile it in my program and then copy it over. The thread needs ...
4
votes
1answer
817 views

Where is the code for a global variable declaration in Ollydbg?

Consider this code snippet: I'm trying to find the code that declares the global variable in Ollydbg. I can't find where it is.
3
votes
1answer
2k views

How to find the size of an array in binary?

I'm currently learning RE and try to understand some basic c programs. I've almost figure out some concepts, but right now i've no idea how to find the size of an array when i use objdump or gdb. ...
0
votes
2answers
464 views

Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?

I am a student of informatics with additional games engineering. I currently have a project about Reverse Code Engineering. Mainly my task is to gather information about the topic "Detecting ...
-1
votes
1answer
146 views

Dictionary attack implementation [closed]

I've found a function which takes as input an ASCII type string and return a value (as string). Doing some strings on the DLL I was able to find a couple of keys, however I would like to discover ...
4
votes
1answer
926 views

Insert jmp detour into a compiled program

I've seen references on Stack Exchange and elsewhere to inserting detours into compiled code. My understanding is that essentially a jmp instruction is inserted and then somehow the patched program is ...
2
votes
3answers
2k views

exploit - Why not execute shellcode with the inline assembler?

The typical structure of executing shell code is the following-: (The code snippet is taken from here) char shellcode[] = ""; /* global array */ int main (int argc, char **argv) { ...
2
votes
1answer
2k views

Simple Program Being Paused Somewhere in ntdll

The following is a simple program I wrote to be debugged in OllyDbg: main(){ exit(0); } I compiled the program and opened it in OllyDbg. The program pauses at some weird location in ntdll. I ...
1
vote
0answers
74 views

Creating shared object library to switch out loaded methods

Is it possible to create a dynamic library libXXX.so with android ndk that has a function that switches out methods in loaded classes in the dvm and call it from any apk ? There are functions within ...
0
votes
1answer
1k views

Why ELF headers are included in the process memory

The running process has nothing to do with the program headers but when we print the address(0x08048000) we can see the ELF header starting with "\x7fELF..". It looks like so much of page memory is ...
8
votes
3answers
726 views

What methodology can be used to change code flow atomically during program execution?

I have been reading a lot about the different techniques for Windows API hooking (a technique I'm particularly fascinated by and fond of), and it seems a major problem in implementing a realiable ...
5
votes
2answers
4k views

How to hook the entry point of a DLL?

I have written a C API with support for static import hooking via overwriting the corresponding IAT entry of an exported function. It works nicely for older simple applications, but for more modern ...
1
vote
2answers
310 views

Does MSVCXXX.dll means that the PE file is compiled by Microsoft Visual C?

While viewing the PE headers and imported functions of some programs designed with visual C. I found that they all include one of these functions: MSVCRT.DLL MSVCR80.DLL MSVCR90.DLL MSVCR100D.DLL ...
1
vote
2answers
2k views

Command Injection in Windows ShellExecuteA()?

Imagine that we have the following pseudo-code in a Windows application: ShellExecuteA(0, "open", &File, &Parameters, &Directory, 1); And, imagine that you can gain control over the ...
-1
votes
3answers
1k views

How to understand the “lpStartAddress”-Parameter of the function CreateThread

I have the following assembly code : ..... lea eax, [ebp+ThreadID] push eax ; lpThreadID push 0 ; dwCreationFlags push 0 ; lpParameter push offset ...
-7
votes
1answer
7k views

Convert C to MIPS assembly code? [closed]

You could help solve this problem? Best regards! int bonus(int *l, int n){ int i, j, aux; for(i = 0; i < n; i++){ for(j = 0; ...
4
votes
6answers
6k views

How to match disassembled instructions back to C/C++ source?

Basically here's what I want to know, if you have a disassembled instruction say: jz 0x8048e1a And, you also have the source code. How do you go about figuring out what this instruction relates to ...
4
votes
3answers
1k views

compiled binary - what do disassembled instructions correspond to in C/C++ source (Linux GCC)

sorry about the messy title! Basically here's what I want to know. This might sound a bit silly but, if you have a disassembled instruction say: jz 0x8048e1a and you also have the source code, how ...
4
votes
1answer
5k views

How can a format string vulnerability be used to write a specific string into memory?

I think I understand how a format string vulnerability works, but what I have seen so far it can only be used to increase the value of an integer. Can format string vulnerability also be used to ...
4
votes
5answers
481 views

Transforming an assembly line into C

When I see the assembly line: MOV ESI, DWORD PTR DS:[EBP+0x8] And, when Ollydbg shows me that [EBP+0x8] = 00000000, then can I write it in C like this: int *esi = NULL; Or, should I use the ...
3
votes
5answers
4k views

How do you compare C source code with the corresponding binary's assembly in IDA Pro?

I'm wondering if there's a way to compare source code to the disassembled assembly in IDA Pro? (e.g. I compile hello.c in Linux then open the binary in IDA Pro in OS X, and would like to compare the ...
4
votes
4answers
1k views

Why addresses of variable on stack are not consecutive?

The code below is generated by gcc from a simple scanf program. My question is that Why these 3 addresses of variables are not consecutive when allocated? If not, when could I speculate the number ...
4
votes
1answer
1k views

IDA Pro C dump for Decryption function

I have been battling this infection I got that encrypts my files in 512 byte chunks with a friend. We have managed to find the Decryption function we think in IDA (the code is heavily obfuscated) from ...
2
votes
1answer
996 views

C What kind of sorting algorithm is this?

I decompiled a application and found what seems like some kind of sorting algorithm, I was told it's not even a sorting algorithm, but a binary search on stackoverflow I just don't know which one it ...
6
votes
2answers
1k views

Understanding x86 C main function preamble created by Visual C++

I was debugging a simple x86-64 program in Visual Studio 2010 and I noticed that the main function preamble is different from the GNU GCC compiled version of the same C program. To illustrate what I ...
2
votes
1answer
17k views

Convert MIPS assembly code to C? [closed]

Can someone help me convert the following MIPS code back to C? Assume that the variables f, g, h, i, and j are assigned to registers $s0, $s1, $s2, $s3, and $s4, respectively. Base address of the ...