Questions tagged [c]

General purpose programming language that uses the procedural and structured programming paradigm.

Filter by
Sorted by
Tagged with
2
votes
1answer
863 views

Why is fastcall used for replacing thiscall functions in memory instead of cdecl?

Assume I were to be reversing some game which processes all of it's movement client side and have determined some function to be of the type: bool __thiscall Player::CanJump(Player *this) that I ...
2
votes
2answers
2k views

Translating x86-64 assembly to C

I'm trying to convert x86-64 assembly into C code, but am still unsure about some of the lines. This is the assembly code: .... pushq %rbp movq %rsp, %rbp subq $20, %rsp movl %edi, -...
2
votes
2answers
749 views

How to extract debug information from a DOS executable compiled with Watcom C/C++?

I have a DOS executable which has been compiled with Watcom C/C++ 10.0. That EXE has debug symbols inside. I was wondering if there is any tool that allow to dump or extract that debug information (...
2
votes
1answer
614 views

How do I find a collision for a simple hash algorithm

I have the following hash algorithm: unsigned long specialNum=0x4E67C6A7; unsigned int ch; char inputVal[]=" AAPB2GXG"; for(int i=0;i<strlen(inputVal);i++) ...
2
votes
2answers
2k views

How can I write my main function as assembly opcodes in an integer array?

My OS is Windows 7 64-bit and my processor is an Intel Core i7-4700MQ running on the x64 architecture. My program is 32-bit. Recently, I read an article here describing how it is possible and legal ...
2
votes
1answer
50 views

Is there a way to name a flag for a bit field in Ghidra?

In a line like this: if ((my_variable & 0x80000000) == 0) { Is there a way to label 0x80000000 as e.g. FLAG_HAS_PROPERTY_GREEN, or would I have to rely on comments for that?
2
votes
1answer
155 views

Extracting strings from binary files (.exe)

This question has been asked quite a lot especially on stackoverflow, but the solutions/replies are not clear or extensive. What I`m looking for is to build what Strings does from Sysinternals. My ...
2
votes
1answer
973 views

Ghidra error when edit main signature function

I'm new to ghidra. I download the easy_reverse from crackme.one and open the executable file in ghidra. When I'm trying to edit the main function signature I get an error: Can't parse name: argv[]. I ...
2
votes
2answers
725 views

Why are there so much more functions in ida than my source code?

I am trying to learn how to use IDA Pro 6.8 to analyze binaries. However, there are much more functions in ida function list than my code. For example, there is a function in source code that calls ...
2
votes
1answer
1k views

problem with scanf/fgets in angr stdin exploration

I want to solve this very basic crackme using angr: #include <stdio.h> #include <string.h> int main(int argc, char *argv[]) { char buffer[64]; printf("Mot de passe:\n"); ...
2
votes
1answer
2k views

How can I see the heap data in ollydbg?

I have a C compiled binary that allocates an array of chars into the heap via HeapAlloc(). I would like to be able to see the allocated dynamic array in the heap using Ollydbg to be able to trace it ...
2
votes
1answer
572 views

Mach-O : Convert virtual address to file offset on disk

Hello reverse engineers, I am reverse engineering a Mach-O executable for iOS. File says: Mach-O universal binary with 2 architectures: [arm_v7: Mach-O arm_v7 executable] [64-bit architecture=12]. I ...
2
votes
2answers
4k views

Changing Entrypoint in ELF executable

I wrote some code that does the following: Searches for and finds an offset in a binary file to add code (looks for a sequence of 00s I can overwrite). Then, I change the entrypoint of the ELF to ...
2
votes
1answer
3k views

Help me reverse this

It's been 4 nights I'm struggling decompiling this one. It's an Android native library that I ran through IDA to get C code. Java signature : byte[] resultArray = new byte[-2 + dataArray.length]; ...
2
votes
1answer
2k views

what means this lines in assembly program (compile from c)?

I have code in C: int a() { char string[100]; } When I compile this I get code in assembly: a: push rbp mov rbp, rsp sub rsp, 112 mov rax, QWORD PTR fs:40 <---- mov ...
2
votes
1answer
2k views

How to get the information of "how many and which symbols are resolved by linker"?

The test is on 32-bit Linux, x86. With gcc 4.6.3 and GNU ld 2.22. So I am trying to get the information of "how many symbols are resolved by linker" during link time? And how can I list the ...
2
votes
1answer
3k views

Simple Program Being Paused Somewhere in ntdll

The following is a simple program I wrote to be debugged in OllyDbg: main(){ exit(0); } I compiled the program and opened it in OllyDbg. The program pauses at some weird location in ntdll. I ...
2
votes
2answers
112 views

Newbie problems exploiting a format string vulnerability

I encountered a print format vulnerability challenge in a CTF. I don't know anything about these vulnerabilities, so I'm working my way through Saif El-Sherei's format string exploitation tutorial ...
2
votes
2answers
1k views

IDA pro: jump back to previous instruction

I'm new with IDA pro and currently running with debugger, I have few questions: How can I jump on previous instruction? Undo the latest instruction ? Is it possible in IDA to examine memory of an ...
2
votes
1answer
8k views

How does scanf interact with my code in assembly

I have recently started getting into assembly for the purpose of reverse engineering. I started small with understanding basic datatypes, but I want to move on to more complex datatypes and functions. ...
2
votes
1answer
168 views

Unable to properly analyze a very simple C-compiled program

I'm a RE beginner and I decided to start writing my own simple code for practice. I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
2
votes
4answers
491 views

Cannot understand var passing to function in code compiled with dev c++ [duplicate]

I'm not understating why the parameters to printf are passed this way. mov [esp+20h+var_1C], eax mov [esp+20h+Format], offset Format ; "%d" Why esp is added with 20h then substracted with 20h ...
1
vote
2answers
2k views

explain c compile code

I compile c code to arm with this site https://godbolt.org/ int F(int a, int b) { int c=0; for(int i=0;i<=10;i++) { c+=a+b; } return c; } the result was F(int, ...
1
vote
2answers
181 views

Globally allocated arrays optimization

I compile C code snippet with VS2010 by two ways: int g_arra[3]; int main() { int idx = 2; g_arra[0] = 10; g_arra[1] = 20; g_arra[2] = 30; g_arra[idx] = 40; return 0; } With /O2 ...
1
vote
3answers
206 views

I'm looking for a list of C vulnerabilities like OWASP Top 10

I'm looking for a list of all vulnerabilities that can be present in C so I can practice them all. I found this: Category:C/C++, but it's not of much use.
1
vote
2answers
605 views

Understanding an if statement in assembly

I have written two simple C programs (one with an if and one without). Looking at the assembly differences there are a few lines that I can't manage to explain and was hoping to get some assistance. ...
1
vote
1answer
1k views

Retrieving the contents of PE file sections

I am trying to get the contents of the .text section of a file (notepad.exe) using the following code: #define SECHDROFFSET(a) ((LPVOID) ( (LPBYTE) a + \ ((...
1
vote
2answers
636 views

How can I change the a port a program listens on?

I want to change the port number a program listens on. The program is a proprietary linux binary, Plex, that always listens to tcp port 32400 (hard-coded). Since I want to run this on a shared server,...
1
vote
2answers
172 views

High-level langage decompiler on WIndows

So I have been using Binary ninja and I was wondering if there was any other tool except IDA or any binary ninja plugin that would transform assembly code into high level code, I already tried binja-...
1
vote
1answer
444 views

How to find status and path of the specific module with C in the windows? [duplicate]

How to find status and path of the specific module with C in the windows? such as windbg lm (list loaded module) kd> lm m cdd start end module name 93ae0000 93afe000 cdd (...
1
vote
1answer
581 views

What is the difference between these two function prologue instruction sequences?

the test is on 32-bit x86. I compiled the code with gcc 4.2, optimization level o2. I compiled the C code into binary, and then use objdump to disassemble it. Here are two sequences of instructions ...
1
vote
1answer
1k views

What knowledge do I need to read "The IDA Pro Book"?

I'm interested in vulnerability research and I want to get started in reading the book mentioned in the title. But the thing is that while I'm fairly confident in Python and PHP, I absolutely have no ...
1
vote
2answers
126 views

Using a buffer overflow to call a function

I'm new to reverse engineering C binaries but have been working on an old ctf and thought to ask for explanation of specific assembly commands and how a buffer overflow might force a function to be ...
1
vote
1answer
137 views

Arrays assembly

I'm reversing my C array's programs where I'm storing numbers in arrays like this... int marks[5]; marks[0] = 1; marks[1] = 3; marks[2] = 2; marks[3] = 7; marks[4] = 9; so the compiler showing me the ...
1
vote
5answers
348 views

C representation of simple assembly

I have the following very simple X86 assembly: shr cx, 1 jae short <addr> So basically, the jump will be taken if the Carry flag is not set. In the case of shr, CF will be set to the value of ...
1
vote
1answer
562 views

re-construction of c code: movsx with test instruction

I just started learning about reconstructing C code from assembler instructions. I have the following piece of assembler code: mov eax dword ptr [ebp+8] add eax, dword ptr[ebp-4] movsx ecx, byte ptr ...
1
vote
1answer
851 views

Assembly and C++

I'm trying to learn Reverse Engineering, at this time I compile C++ code without any optimization and see the correspond assembly in IDA's disassembler, but there are some parts of the code, where I ...
1
vote
2answers
922 views

C/C++ to Assembly language

Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
1
vote
1answer
10k views

Hex Rays - strange functions __ROL4__ and __ROR4__

What's purpose of functions ROL and ROR? For both of them, first arg is int, and second is byte I suppose that's bitwise shifts ]1s]2
1
vote
1answer
266 views

Does empty enumeration in C structure creates unnamed field?

I was parsing some modified C++ headers with IDA when I come to some strange behavior. Imagine we have a structure like this (stored in a C header): struct S { enum {EN0, EN1}; int m1; } ; ...
1
vote
1answer
141 views

Discrepancies in function declarations from decompilers?

An Android application I'm analyzing makes calls to a native library to generate a certain value. Here's an example of the native library function declaration from SMALI (Decompiled Java): .method ...
1
vote
3answers
777 views

Dump global datas to disk in assembly code

the experiment is on Linux, x86 32-bit. So suppose in my assembly program, I need to periodically (for instance every time after executing 100000 basic blocks) dump an array in .bss section from ...
1
vote
1answer
178 views

Declaration of a complex C expression

I used IDA Pro and got the following expression from a produced C file: v25 = (*(int (**)(void))(v22 + 464))(); I am trying to figure out the meaning of the above expression with the following links:...
1
vote
1answer
871 views

Address of loaded driver on memory [closed]

How find address of loaded specific driver on memory by C language in windows os thanks
1
vote
1answer
41 views

Why does this x64 stack have other bytes and seems to be in reverse order?

I wrote the following small C program and you can also see the stack in the screenshot. My question is twofold: How come there are entire rows of other data between the 3 stack strings? Why is my ...
1
vote
1answer
76 views

Is there a handy assembly to mock app conversion tool?

It might be too silly of a question, but here you go. Suppose you have some software that contains a tricky nested assembly sequence (like this one) you try to reverse engineer. brain*[pen&paper] ...
1
vote
2answers
186 views

Detecting and solutions of stack smash protection

This video https://youtube.com/watch?v=4HxUmbOcN6Y presents how modern compilers protect stack overflows with stack cookies and function __stack_chk_fail. How can one identify if a binary has stack ...
1
vote
1answer
188 views

(CTF) Speed up assembly by hooking to an static function

For a CTF I have a fairly slow recursive function. I just need to cached the previous results in a dictionary and get them instead. I did it but had to reverse engineer the code. I was wondering if ...
1
vote
1answer
1k views

How int3 looks like in C

This is assembly code that can catch debugger with int 3 : MOV ECX, ExceptionHandler MOV DWORD PTR FS:[0], ExceptionHandler INT3 ///there is debugger!!! ExceptionHandler: ////no ...
1
vote
1answer
74 views

Generate this assembly from a c program

I want to generate this assembly code: mov ecx, <absolute address of func1> call ecx How can I write and compile C code which generates this code?

1 2
3
4 5
7