Questions tagged [c]

General purpose programming language that uses the procedural and structured programming paradigm.

Filter by
Sorted by
Tagged with
1
vote
2answers
503 views

How can I change the a port a program listens on?

I want to change the port number a program listens on. The program is a proprietary linux binary, Plex, that always listens to tcp port 32400 (hard-coded). Since I want to run this on a shared server,...
1
vote
1answer
682 views

Address of loaded driver on memory [closed]

How find address of loaded specific driver on memory by C language in windows os thanks
1
vote
1answer
310 views

How to find status and path of the specific module with C in the windows? [duplicate]

How to find status and path of the specific module with C in the windows? such as windbg lm (list loaded module) kd> lm m cdd start end module name 93ae0000 93afe000 cdd (...
1
vote
2answers
137 views

During debugging, is the process memory the same as the debugger's memory space?

This post might be specific to IDA Pro, so bear that in mind. I'm currently trying to write a plugin for debugging specifically one executable. I know that a certain object in the executable's ...
5
votes
2answers
249 views

Returning a C function to its grandfather

This is a homework assignment, so I'd appreciate it if I would get a hint only, not a full answer. I wrote this program which is supposed to print the following: Executing function_a Executing ...
2
votes
1answer
6k views

64-bit integers on 32-bit machines

Let's say I create a program in C like this and compile it on a regular 64-bit desktop machine: #include <stdint.h> int main(void) { uint64_t a = 0x12345679abcdefULL; uint64_t b = ...
3
votes
0answers
1k views

Reverse Engineering a 8 bit CRC checksum

I am trying to create a communication interface using C Language to an Air conditioning system, after analyzing the data packets I have identified that the data packet is consist of an 8 bit CRC (I am ...
2
votes
1answer
1k views

How to get the information of “how many and which symbols are resolved by linker”?

The test is on 32-bit Linux, x86. With gcc 4.6.3 and GNU ld 2.22. So I am trying to get the information of "how many symbols are resolved by linker" during link time? And how can I list the ...
3
votes
1answer
11k views

what's the function of LODWORD and HIDWORD?

I'm trying to figure out what does this piece of code exactly: LODWORD(fMax) = *(_DWORD *)v12; HIDWORD(fMax) = v13; I was reading on IDA\Plugins\defs.h the definition, but I don't understand ...
0
votes
3answers
241 views

Is it possible to programmatically search a disassembly for functions missing bounds checks?

Suppose I was to search a file for dangerous C functions: Assuming that we can perform a dissassembly, and that we cannot perform dynamic analysis is it possible to definitively identify a lack of ...
1
vote
0answers
518 views

Define new code section in assembly code to compile ELF binary

I defined a new code section in my assembly program, which is going to be compiled into 32-bit ELF binary, on x86. I use the linker scripts to assign a specified address for this new code section, it ...
1
vote
1answer
486 views

How to load library defined symbols to a specified location?

The test is on Ubuntu 12.04, 32-bit, with gcc 4.6.3. Basically I am doing some binary manipulation work on ELF binaries, and what I have to do now is to assemble a assembly program and guarantee the ...
2
votes
2answers
2k views

How can I write my main function as assembly opcodes in an integer array?

My OS is Windows 7 64-bit and my processor is an Intel Core i7-4700MQ running on the x64 architecture. My program is 32-bit. Recently, I read an article here describing how it is possible and legal ...
-1
votes
2answers
32k views

EXE to C source code decompiler [duplicate]

Is there any decompiler out there which can take a .exe file and decompile it into C code (the execution file was also written in C)? Obviously I'm not looking for a 1 to 1 results with the original ...
1
vote
3answers
681 views

Can one modify a program by “wrapping” its binary? What tools exist?

(This question is related to How do I add functionality to an existing binary executable?). I too would like to add functionality to an existing application, but I do not want to modify the original ...
8
votes
1answer
1k views

Becoming A Better Reverse Engineer

I have been looking on the net and all I see when it comes to reverse engineering are a bunch of silly crackme tutorials. I want to be better at taking code from assembly to c or c++. I am getting the ...
0
votes
1answer
877 views

Convert C/C++ function to raw bytes [closed]

I'm planning to inject a thread into another process and unfortunately I need to write the thread function in raw bytes and can't just compile it in my program and then copy it over. The thread needs ...
4
votes
1answer
790 views

Where is the code for a global variable declaration in Ollydbg?

Consider this code snippet: I'm trying to find the code that declares the global variable in Ollydbg. I can't find where it is.
3
votes
1answer
2k views

How to find the size of an array in binary?

I'm currently learning RE and try to understand some basic c programs. I've almost figure out some concepts, but right now i've no idea how to find the size of an array when i use objdump or gdb. ...
0
votes
2answers
450 views

Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?

I am a student of informatics with additional games engineering. I currently have a project about Reverse Code Engineering. Mainly my task is to gather information about the topic "Detecting ...
-1
votes
1answer
146 views

Dictionary attack implementation [closed]

I've found a function which takes as input an ASCII type string and return a value (as string). Doing some strings on the DLL I was able to find a couple of keys, however I would like to discover ...
3
votes
1answer
894 views

Insert jmp detour into a compiled program

I've seen references on Stack Exchange and elsewhere to inserting detours into compiled code. My understanding is that essentially a jmp instruction is inserted and then somehow the patched program is ...
2
votes
3answers
2k views

exploit - Why not execute shellcode with the inline assembler?

The typical structure of executing shell code is the following-: (The code snippet is taken from here) char shellcode[] = ""; /* global array */ int main (int argc, char **argv) { ...
2
votes
1answer
2k views

Simple Program Being Paused Somewhere in ntdll

The following is a simple program I wrote to be debugged in OllyDbg: main(){ exit(0); } I compiled the program and opened it in OllyDbg. The program pauses at some weird location in ntdll. I ...
1
vote
0answers
74 views

Creating shared object library to switch out loaded methods

Is it possible to create a dynamic library libXXX.so with android ndk that has a function that switches out methods in loaded classes in the dvm and call it from any apk ? There are functions within ...
0
votes
1answer
1k views

Why ELF headers are included in the process memory

The running process has nothing to do with the program headers but when we print the address(0x08048000) we can see the ELF header starting with "\x7fELF..". It looks like so much of page memory is ...
8
votes
3answers
712 views

What methodology can be used to change code flow atomically during program execution?

I have been reading a lot about the different techniques for Windows API hooking (a technique I'm particularly fascinated by and fond of), and it seems a major problem in implementing a realiable ...
5
votes
2answers
4k views

How to hook the entry point of a DLL?

I have written a C API with support for static import hooking via overwriting the corresponding IAT entry of an exported function. It works nicely for older simple applications, but for more modern ...
1
vote
2answers
307 views

Does MSVCXXX.dll means that the PE file is compiled by Microsoft Visual C?

While viewing the PE headers and imported functions of some programs designed with visual C. I found that they all include one of these functions: MSVCRT.DLL MSVCR80.DLL MSVCR90.DLL MSVCR100D.DLL ...
1
vote
2answers
2k views

Command Injection in Windows ShellExecuteA()?

Imagine that we have the following pseudo-code in a Windows application: ShellExecuteA(0, "open", &File, &Parameters, &Directory, 1); And, imagine that you can gain control over the ...
-1
votes
3answers
1k views

How to understand the “lpStartAddress”-Parameter of the function CreateThread

I have the following assembly code : ..... lea eax, [ebp+ThreadID] push eax ; lpThreadID push 0 ; dwCreationFlags push 0 ; lpParameter push offset ...
-7
votes
1answer
7k views

Convert C to MIPS assembly code? [closed]

You could help solve this problem? Best regards! int bonus(int *l, int n){ int i, j, aux; for(i = 0; i < n; i++){ for(j = 0; ...
4
votes
6answers
6k views

How to match disassembled instructions back to C/C++ source?

Basically here's what I want to know, if you have a disassembled instruction say: jz 0x8048e1a And, you also have the source code. How do you go about figuring out what this instruction relates to ...
4
votes
3answers
1k views

compiled binary - what do disassembled instructions correspond to in C/C++ source (Linux GCC)

sorry about the messy title! Basically here's what I want to know. This might sound a bit silly but, if you have a disassembled instruction say: jz 0x8048e1a and you also have the source code, how ...
4
votes
1answer
5k views

How can a format string vulnerability be used to write a specific string into memory?

I think I understand how a format string vulnerability works, but what I have seen so far it can only be used to increase the value of an integer. Can format string vulnerability also be used to ...
4
votes
5answers
481 views

Transforming an assembly line into C

When I see the assembly line: MOV ESI, DWORD PTR DS:[EBP+0x8] And, when Ollydbg shows me that [EBP+0x8] = 00000000, then can I write it in C like this: int *esi = NULL; Or, should I use the ...
3
votes
5answers
4k views

How do you compare C source code with the corresponding binary's assembly in IDA Pro?

I'm wondering if there's a way to compare source code to the disassembled assembly in IDA Pro? (e.g. I compile hello.c in Linux then open the binary in IDA Pro in OS X, and would like to compare the ...
4
votes
4answers
1k views

Why addresses of variable on stack are not consecutive?

The code below is generated by gcc from a simple scanf program. My question is that Why these 3 addresses of variables are not consecutive when allocated? If not, when could I speculate the number ...
4
votes
1answer
1k views

IDA Pro C dump for Decryption function

I have been battling this infection I got that encrypts my files in 512 byte chunks with a friend. We have managed to find the Decryption function we think in IDA (the code is heavily obfuscated) from ...
2
votes
1answer
996 views

C What kind of sorting algorithm is this?

I decompiled a application and found what seems like some kind of sorting algorithm, I was told it's not even a sorting algorithm, but a binary search on stackoverflow I just don't know which one it ...
6
votes
2answers
1k views

Understanding x86 C main function preamble created by Visual C++

I was debugging a simple x86-64 program in Visual Studio 2010 and I noticed that the main function preamble is different from the GNU GCC compiled version of the same C program. To illustrate what I ...
2
votes
1answer
16k views

Convert MIPS assembly code to C? [closed]

Can someone help me convert the following MIPS code back to C? Assume that the variables f, g, h, i, and j are assigned to registers $s0, $s1, $s2, $s3, and $s4, respectively. Base address of the ...
2
votes
3answers
575 views

Concept of location local variables in memory using disassembly window and registers?

I'm trying to understand how to locate local variables in memory. I have disassembled a c code and I have the address of the instructions. I want the memory location where that variable is stored. I ...
2
votes
1answer
369 views

What C construct could generate this assembly sequence?

I have the following disassembly: mov BL, [EAX] inc EAX mov [EDX], BL inc EDX I could see this being the result of: uint8_t foo = bar; ++bar; uint8_t tmp = foo; ++foo; But this assumes C99. Is ...
3
votes
2answers
533 views

How to compile c, cpp and python code as “Released/Final” version?

I want to know if there are ways to compile C, C++ and Python code in order to not be able to reverse engineering it over Linux or not? I have heard there are some ways over Windows to do it, but I ...
6
votes
4answers
104k views

Converting assembly code to c

I have the following assembly code over Linux distro: # using the .data section for write permission # instead of .text section .section .data .globl _start _start: # displaying some characters ...
5
votes
1answer
1k views

Chunked function (discontinuous chunks of code comprising a function)

The control flow graph below is from a single function in Notepad (Win7 64-bit). Why is the linker (or the compiler) separating the basic blocks of a single function into multiple, discontinuous ...
9
votes
1answer
486 views

How to convert this one-liner asm to C

I want to convert this to C: SHR CL,1 rECX is the name of the (32bit unsigned int)register variable. It should be simple, but I can't figure out the proper pointer magic :/
6
votes
1answer
10k views

Illegal Instruction exploiting sample Buffer Overflow code

Some days ago I coded a simple code to test a buffer overflow exploitation on x86 system. In order to keep it simple I disabled ASLR and NX so there are no protection that could cause weird behaviours....
4
votes
1answer
287 views

What does this Generate_Key_IV assembler routine?

I want to decompress some files, and found some information on how. Apparently they are encrypted with AES 128 in CFB mode, and sometimes compressed using ZLIB. Each file's key and IV is supposedly ...