Questions tagged [c]

General purpose programming language that uses the procedural and structured programming paradigm.

Filter by
Sorted by
Tagged with
1
vote
1answer
155 views

Unknown comparison

I'm trying to decompile some singleplayer code for a game (C++ on X86 architecture Linux). I do this with the help of some already available source code, a file (compiled on linux) with debug ...
0
votes
1answer
137 views

IDA: Two calls of a same function

I was reversing some executable and came across to this code: As I found out later, it's using function pointer to call function sub_4011C0 and that could be the reason. My question is why does ...
1
vote
2answers
605 views

Understanding an if statement in assembly

I have written two simple C programs (one with an if and one without). Looking at the assembly differences there are a few lines that I can't manage to explain and was hoping to get some assistance. ...
3
votes
3answers
1k views

Exports that redirects to other library

I'm writing an analog of GetProcAddress function. When looking inside the export table I see the exports like this in advapi32.dll for example: .text:4C362BAA aEventregister db 'EventRegister',0 ;...
4
votes
2answers
1k views

Inverse And operation

I'm trying to write a keygen to a crack me that I'm learning from and I got stuck. What happens there is pretty simple: Let's say that I entered the password: "12121212" XOR DWORD PTR DS:[ECX+EAX],...
1
vote
1answer
1k views

Calling Swift 4 methods from C

I have earlier been able to call Swift methods using a function pointer from C, and providing the appropriate arguments because the calling convention was the same. Unfortunately this no longer works....
1
vote
2answers
1k views

IDA Pro - Applying function signatures

I have three files: ELF executable, ELF dynamically linked library (.so), C headers file (.h) with function signatures and related structures for that library. #1 imports a number of functions from #...
4
votes
2answers
186 views

What's the best way of improving already compiled binary?

Like if I want to patch a function in a PE. Now my way of doing this would be inserting a new section using lets say LordPE and then compiling anything I want to add up here and patching the original ...
1
vote
1answer
169 views

Need help reversing this loop

I am having a difficult time reversing the following loop: │ ┌─< 0x100001fea 723b jb 0x100002027 │ │ 0x100001fec 31db xor ebx, ebx ; ebx = ...
-1
votes
1answer
1k views

Aside from Assembly, should I learn C or C++?

With Malware/Virus analysis being heavily dependant on one's ability to read the the Assembly Code generated by the Disassembler... being familiar with the Assembly Language is naturally the most ...
2
votes
2answers
1k views

IDA pro: jump back to previous instruction

I'm new with IDA pro and currently running with debugger, I have few questions: How can I jump on previous instruction? Undo the latest instruction ? Is it possible in IDA to examine memory of an ...
2
votes
1answer
572 views

Mach-O : Convert virtual address to file offset on disk

Hello reverse engineers, I am reverse engineering a Mach-O executable for iOS. File says: Mach-O universal binary with 2 architectures: [arm_v7: Mach-O arm_v7 executable] [64-bit architecture=12]. I ...
2
votes
2answers
4k views

Changing Entrypoint in ELF executable

I wrote some code that does the following: Searches for and finds an offset in a binary file to add code (looks for a sequence of 00s I can overwrite). Then, I change the entrypoint of the ELF to ...
6
votes
2answers
19k views

Radare2 C output

I made a simple hello world program, and put it in radare2. I then ran the pc command, which displayed C output. The output was this: #define _BUFFER_SIZE 256 const uint8_t buffer[256] = { 0x55, ...
0
votes
2answers
804 views

c++ version of MOV AL,BYTE PTR DS:[ESI]

I'm writing a keygen for a crack-me exercise. I have a problem with handling byte assignments the crack-me performs several times using instructions like MOV AL,BYTE PTR DS:[ESI] (move byte from ...
0
votes
1answer
86 views

Which environmental variables can be used alter control flow and keep suid?

I am working on a challenge where it is possible to manipulate environmental variables (in C). I know that with PATH it is possible to execute arbitrary programs when relative path is used, for ...
2
votes
1answer
2k views

Basic Buffer Overflow Help

I am currently practicing for a CTF competition and one of the practice challenges is a buffer overflow exploit. Before this challenge I knew absolutely nothing about these exploits, but I've been ...
7
votes
1answer
316 views

Is there a way to find out which hash standard by studying the source code?

We have an embedded product, which we are carrying for several hardware iterations since more than 5 years ago. We have all the source code, most of it nicely documented. As the product is actively ...
-1
votes
1answer
1k views

what is best forum to ask about hex reversing? [closed]

i want to create c script extract encrypt package. just can open it in hex editor to view and need knowledge and technique for write script for extract it. Script will work in command-line ( window 10 ...
1
vote
0answers
52 views

Fighting programs that don't respond to Send/PostMessage-based input

This can be difficult to ask because 1) people assume this is necessarily malicious and 2) unrelated but effectual techniques like GetForegroundWindow can make this impossible to answer. So, to keep ...
3
votes
1answer
1k views

Identifying possible structs in C/C++ disassembly

I'm currently working on taking apart a game (Soul Reaver: Legacy of Kain) and I often come across odd looking sections such as this in the decompiler *(_DWORD *)(a2 + 16) = a2 + 624; *(_DWORD *)(...
1
vote
1answer
2k views

Finding hidden string location using radare2 on ELF binaries

I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries. I was provided these by a colleague and can be ...
1
vote
1answer
851 views

Assembly and C++

I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...
3
votes
1answer
3k views

Can't get buffer to overflow over function pointer

I cannot get this buffer overflow exploit to work for the life of me. The source code is here. It is from the book, Hacking the Art of Exploitation. The subject here is the below struct: struct user {...
0
votes
0answers
65 views

What memory security settings are needed to allow a basic buffer overflow on Fedora 25?

I'm having a rather difficult time determining what memory security settings need to be adjusted on a fresh install of Fedora 25 in order to perform basic buffer overflows in the C language. As a ...
0
votes
1answer
825 views

Question about reading addresses/offsets in C++ within a hooked function

I'm a beginner at this and I'm following tutorials but I am kind of stuck. I found a function that accesses all characters X position in game. I found this using Cheat Engine and here's how it looks: ...
0
votes
2answers
159 views

Antidebug/reverse engineering targeted for libraries [closed]

So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables. Are there any resources that target specifically shared and ...
0
votes
1answer
3k views

IDA pseudo code decompilation

I am trying to reverse engineer exe file and have some difficulties of pseudo code understanding. Can someone please help me understand what is doing the code below: char __userpurge sub_41C140@<...
-1
votes
2answers
189 views

which windows API called when execute wmic qfe get hotfixid command?

which windows API called when execute this command wmic qfe get hotfixid command?
1
vote
2answers
922 views

C/C++ to Assembly language

Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
2
votes
2answers
2k views

Translating x86-64 assembly to C

I'm trying to convert x86-64 assembly into C code, but am still unsure about some of the lines. This is the assembly code: .... pushq %rbp movq %rsp, %rbp subq $20, %rsp movl %edi, -...
4
votes
2answers
4k views

When do rep and stos appear in compiled C?

Can you give me some example C code which would be compiled to rep and stos? 00401059 /$ 55 PUSH EBP 0040105A |. 8BEC MOV EBP,ESP 0040105C |. 83EC 5C SUB ESP,5C ...
0
votes
2answers
387 views

dynamic memory allocation

For dynamic memory allocation in C/C++ int main(){ MessageBox(0,"crackname","",0); int * ptr = new int[50]; int * ptr2 = new int[50]; ptr[0] = 0x75; ptr[1] = 0x65; (*ptr) +1 = 0x75; ...
-1
votes
2answers
127 views

*(lpCmd + somenumber)

include int WinMain(HINSTANCE hlnst,HINSTANCE hPrev, LPSTR lpCmd,int nShow){ MessageBox(0,"Insert argument","",0); int i = 0; for(i ; *(lpCmd+i) ; i++ ){ } if(!(i=*(...
-1
votes
1answer
428 views

winmain reversing the assembly to c code

this is I got so far #include <windows.h> int WinMain(HINSTANCE hlnst,HINSTANCE hPrev, LPSTR lpCmd,int nShow){ int k =0; int j= 0 ; MessageBox(0,"crackname","",0); int i; ...
3
votes
1answer
374 views

move with sign extension in c code

I'm quite confused with the movsx(move with sign extension) I'm trying to convert assembly code to C. but stuck with movsx part. this is the code I got so far. #include <stdio.h> #...
3
votes
1answer
970 views

Good foundation for reverse engineering malware

I have been intrigued by reverse engineering recently and just finished Paul Carter's PC Assembly Language book (http://pacman128.github.io/static/pcasm-book.pdf) which was a great primer for x86. My ...
2
votes
2answers
7k views

What is *(_BYTE *), __usercall, eax and edi [closed]

I am trying to understand some algorithm of how the thing works. Here is the function I got from decompiling my executable with Hey Rays. I want to run this function to see the result and then ...
2
votes
1answer
3k views

Help me reverse this

It's been 4 nights I'm struggling decompiling this one. It's an Android native library that I ran through IDA to get C code. Java signature : byte[] resultArray = new byte[-2 + dataArray.length]; ...
2
votes
1answer
2k views

what means this lines in assembly program (compile from c)?

I have code in C: int a() { char string[100]; } When I compile this I get code in assembly: a: push rbp mov rbp, rsp sub rsp, 112 mov rax, QWORD PTR fs:40 <---- mov ...
2
votes
2answers
749 views

How to extract debug information from a DOS executable compiled with Watcom C/C++?

I have a DOS executable which has been compiled with Watcom C/C++ 10.0. That EXE has debug symbols inside. I was wondering if there is any tool that allow to dump or extract that debug information (...
5
votes
2answers
1k views

How to get IDA Pro to understand a virtual function table?

I'm reversing an old DirectDraw game that uses DirectX 7. I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays: (*(int (...
0
votes
1answer
2k views

How can I export a struct in IDA Pro to a c-style struct?

I have a struct in IDA Pro that I want to export to a c-style struct. For example: 00000000 ICreateErrorInfo struc ; (sizeof=0x4, align=0x4, standard type) 00000000 ...
1
vote
0answers
295 views

Extracting information from a windows executable

I've been given the task of writing a functional clone for an executable since we don't have the source code. None of the .NET tools at my disposable recognise it and loading the thing into a text ...
1
vote
0answers
354 views

IDA Pro .til files backward compatibility

I read in the IDA Pro Book that you may use till.exe to parse header files and create standalone .til files which can be made globally available by copying them into <IDADIR>/til. This ...
1
vote
1answer
89 views

Function is returning to somewhere in stack

I'm trying to hook this 'recv callback' function and can manage to hook the function. However, when the 'new function' is supposed to return to its caller, it's instead returning to somewhere in stack,...
1
vote
1answer
10k views

Hex Rays - strange functions __ROL4__ and __ROR4__

What's purpose of functions ROL and ROR? For both of them, first arg is int, and second is byte I suppose that's bitwise shifts ]1s]2
0
votes
1answer
725 views

Arm Assembly: LDRH instruction to C

I've been reversing an asm checksum code for the last days, and I've managed to understand how it completly works, except for one instruction; ldrh The info I've been able to found says that it's ...
-1
votes
1answer
242 views

Why does the C compiler generate integer multiplication with large, seemingly random, numbers?

Hi I want to write those instructions in C, I'm having trouble with SAR EDX,6, ASM MOV EDX,8 MOV EDI,1 IMUL EDI,EDX MOV EAX,ED9CE24E IMUL EDI SAR EDX,6 my try int edi=1 int edx=8 edi*=edx; edx=((...
0
votes
0answers
313 views

How to pass Obfuscated Elf binary to gcc optimization end

Currently I have a 2000+Line function to reverse engineer with many redundancies and appears to be obfuscated. It their a way to pass to pass this binary to gcc or clang to reassemble it and optimize ...

1 2 3
4
5
7