Questions tagged [c]

General purpose programming language that uses the procedural and structured programming paradigm.

Filter by
Sorted by
Tagged with
1
vote
1answer
287 views

Odd convention for accessing elements of an array?

While reverse engineering a game using the Hex Rays decompiler I was looking for how an array of NPC's was accessed. I found the array but I don't quite understand the unusual formula for getting the ...
1
vote
1answer
3k views

What does this assembly instruction do?

push %rbp mov %rsp,%rbp mov %rdi,-0x18(%rbp) mov %rsi,-0x20(%rbp) mov -0x18(%rbp),%rax mov (%rax),%eax mov %eax,-0x4(%rbp) mov -0x20(%rbp),%rax mov (%rax),%edx mov -0x18(%...
1
vote
1answer
155 views

Unknown comparison

I'm trying to decompile some singleplayer code for a game (C++ on X86 architecture Linux). I do this with the help of some already available source code, a file (compiled on linux) with debug ...
1
vote
1answer
89 views

Function is returning to somewhere in stack

I'm trying to hook this 'recv callback' function and can manage to hook the function. However, when the 'new function' is supposed to return to its caller, it's instead returning to somewhere in stack,...
1
vote
2answers
2k views

Command Injection in Windows ShellExecuteA()?

Imagine that we have the following pseudo-code in a Windows application: ShellExecuteA(0, "open", &File, &Parameters, &Directory, 1); And, imagine that you can gain control over the ...
1
vote
1answer
248 views

How to restrict angr to printable characters

I have a binary that scanfs and then does some checks and returns either FAIL or SUCCESS that has SUCCESS for multiple inputs. Although only one of the inputs has only printable characters. How do I ...
1
vote
1answer
138 views

how could i follow a system call from a dll -> kernel driver syscall

basically i would like to follow (system calls / internal calls) that basically lands in the kernel i would like for example to debug a specific dll ex : ntdll.dll and follow it to (NtXXX) function ...
1
vote
1answer
610 views

Ghidra scripting get information from decompile window

I am using Ghidra and when clicking for example in the decompile window on a specific raw, it change the cursor in the assembly window to the exact location in the assembly. Is there any option to do ...
1
vote
1answer
71 views

How to create an executable that keeps the same virtual address on different runs

I want to create an executable that keeps the same virtual address during different execution runs. This is definitely possible because I've seen these files in CTFs(Capture the flag) where the ...
1
vote
2answers
502 views

Methods for preventing IDA decompiler

I want to write a C function, such that hex-rays decompiler will fail on it. I want to do it for study purposes, and not for an actual anti-reversing method. Do you have any recommendations/approaches ...
1
vote
2answers
162 views

How to solve this anti-disassembler trick?

I have this __asm instruction in C code: int func_0x8b4c55a0() { __asm { call $ +5 add[esp],5 ret } } int main() { char cVar1; if ((cVar1 = ...
1
vote
1answer
256 views

mfc140 dll , what is the usage?

While I open exe file in ida I can see lot of calls to mfc140_6153 or mfc140_8718. What are those functions ? what they do ? thanks
1
vote
2answers
2k views

Local variables and addition not shown in Ghidra

I am having some troubles with my learning of Assembly and reverse engineering. Specifically, I am learning about Global vs Local variables. For Global variables I have managed to get insights in ...
1
vote
1answer
1k views

How to pass param to execve to execute cat a file in x64 Asm? [closed]

I want execve("/bin/cat",["/bin/cat","/test/file"],NULL). Here is my asm xor %rdx, %rdx push %rdx sub $0x16, %rsp movb $0x2f, 7(%rsp) movl $0x2f6e6962, 8(%rsp) movl $0x746163, 12(%rsp) leaq 7(%rsp)...
1
vote
2answers
201 views

Trouble when reverse engineering a industrial robot software in order to get some values

For the bit of background, I'm a robotic engineer. Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
1
vote
2answers
173 views

How can I deal with exception handler in Visual C/C++ inline assembly?

I have disassembled a function in IDA Pro and I want to compile it into my project in visual c inline assembly... I'm still a newbie, so let me apologize if I don't use the right terminology...(I'm ...
1
vote
1answer
933 views

Patching branch on assembly code

I compile this code 1. #include <stdio.h> 2. void F(int a, int b) 3. { 4. int c= a+b; 5. int d= a*b; 6. } 7. void printAll() 8. { 9. printf("test1"); 10. printf("test2"); 11. ...
1
vote
1answer
75 views

Is there a static address to a pointer on Mac OS?

Given the sample code below: #include <iostream> struct Data { int a; int b; int c; }; int main() { Data *d = new Data; d->a = 1337; d->b = 1338; d->c = ...
1
vote
1answer
2k views

How can I convert a .bin file to either assembly or C?

I have a .bin file (It's a firmware belongs to a hardware (Cisco Access-Point) ). All I need to do is modifying that .bin file. As you know, .bin files aren't human readable. I need to convert it to ...
1
vote
2answers
1k views

IDA Pro - Applying function signatures

I have three files: ELF executable, ELF dynamically linked library (.so), C headers file (.h) with function signatures and related structures for that library. #1 imports a number of functions from #...
1
vote
1answer
169 views

Need help reversing this loop

I am having a difficult time reversing the following loop: │ ┌─< 0x100001fea 723b jb 0x100002027 │ │ 0x100001fec 31db xor ebx, ebx ; ebx = ...
1
vote
2answers
2k views

Recognizing CLib functions in Ollydbg or IDA

I'm just learning Olly/IDA and writing simple programs in C and looking at the .EXE code in Ollydbg and IDA. Below I have a simple printf Hello World program which I compile in Visual Studio 6. I ...
1
vote
1answer
394 views

How to get the address of KiFastCallEntry from windows wdm driver

Hi i want to hook the KiFastCallEntry function from my Windows Driver , but i dont know how to get the addrres of this function , can someone pls tell me how? Target OS is Windows 7 32 bit
1
vote
2answers
158 views

During debugging, is the process memory the same as the debugger's memory space?

This post might be specific to IDA Pro, so bear that in mind. I'm currently trying to write a plugin for debugging specifically one executable. I know that a certain object in the executable's ...
1
vote
1answer
642 views

How to load library defined symbols to a specified location?

The test is on Ubuntu 12.04, 32-bit, with gcc 4.6.3. Basically I am doing some binary manipulation work on ELF binaries, and what I have to do now is to assemble a assembly program and guarantee the ...
1
vote
0answers
58 views

Confusing objdump with data as code

I am trying to confuse objdump to solve the first exercise of chapter 6 in Practical Binary Analysis. Admittedly I am super weak with inline assembler but I made a best-effort attempt and tried to get ...
1
vote
0answers
80 views

How to create an algorithm in C...(or C# or C++, basically in "a programming language")

After a LOT of sending challenges and recording the responses I've 'broken' the "encryption" in my car's immobiliser...the reason for doing it is so I can use the engine and transmission in ...
1
vote
0answers
39 views

How do I disassemble mips .o object files in ida elf 64bit

So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
1
vote
0answers
51 views

Trying to call the Exit Shellcode in a c program

#include<stdio.h> #include<stdint.h> char shellcode[] = "\xb8\x3c\x00\x00\x00" "\xbf\x14\x00\x00\x00" "\x0f\x05"; int ...
1
vote
0answers
334 views

which has better pseudocode? IDA or Ghidra [closed]

I would like to know which of the two has a better pseudo code generator in C, IDA or Ghidra, if possible, point out the strengths and low points of each one.
1
vote
1answer
161 views

Is Ghidra's decompilation of ARMv7 strb.w instruction broken?

I'm currently disassembling some firmware, when I stumbled across the following code snippet produced by Ghidra (the names are already my own ones): void memset(byte *addr,byte value,int count) ...
1
vote
2answers
734 views

Simple angr example not working

I am trying to learn angr from beginning. Due to lack of simple tutorials I programmed my own little executable which angr should solve. The C code looks as follows: #include <stdio.h> #...
1
vote
0answers
332 views

Some obstacles in reversing a JNI Native library

I deleted my last question (it was not still answered and none's effort was wasted) as I got back and thought to re-read JNI documentation, to find I misinterpreted some bits. Things are now clearer ...
1
vote
0answers
92 views

Static binary instrumentation

I am working on a class project. I need to find out static features of a program (without executing it). Backward branches (loops) Conditional branches (potential threads with load imbalance) ...
1
vote
0answers
162 views

Reconstructing struct/union-based IPC protocol wire format

I'm embarking on my first reverse-engineering adventure. I think I've picked a rather dense piece of steak to start out with. I have three C programs which communicate together using an unknown IPC ...
1
vote
0answers
219 views

Mysterious chunk of code in IOLI crackme0x06 challenge

I've been struggling to understand a very strange piece of x86 assembly code from the IOLI crackme0x06 challenge. Context But first of all, here is the context : I've successfully cracked the ...
1
vote
0answers
493 views

Illegal instruction fault in stack based buffer overflow

I wrote this short C program to practice buffer overflow exploits: #include <stdio.h> #include <string.h> #include <stddef.h> #include <inttypes.h> char *decode(char *s){ ...
1
vote
1answer
253 views

Changing local variable in caller from callee in C? [closed]

I'm implementing a function which is going to perform some time-consuming task, and I'd like to hack the benchmarking part a bit by changing the variable indicating the CPU time my function has ...
1
vote
1answer
983 views

Reading from text file and printing it in IDA Pro

I have a text.txt file and I want to read it and print its content in the Output Window of IDA Pro (Free version). I wrote an .idc script as follows: #include <idc.idc> static main() { ...
1
vote
0answers
90 views

Decompiled code calls a function with unitialized variables

I'm working on decompiling the scripting engine from the game Rayman 2. It's going pretty well, but I'm getting stuck on a particular function which calls another function with arguments that aren't ...
1
vote
0answers
983 views

How to decrypt .jpg files of comics app in a C Program?

I'm trying to decrypt jpg images of comics I purchased in my comic reader app on android but neither I can view them (after copying from SD card to Windows desktop) nor can I convert them to pdf to ...
1
vote
0answers
52 views

Fighting programs that don't respond to Send/PostMessage-based input

This can be difficult to ask because 1) people assume this is necessarily malicious and 2) unrelated but effectual techniques like GetForegroundWindow can make this impossible to answer. So, to keep ...
1
vote
1answer
2k views

Finding hidden string location using radare2 on ELF binaries

I'm working through some reverse engineering sample programs (IOLI crackmes) crackme0x00 - crackme0x09 which are gcc compiled ELF format binaries. I was provided these by a colleague and can be ...
1
vote
0answers
295 views

Extracting information from a windows executable

I've been given the task of writing a functional clone for an executable since we don't have the source code. None of the .NET tools at my disposable recognise it and loading the thing into a text ...
1
vote
0answers
354 views

IDA Pro .til files backward compatibility

I read in the IDA Pro Book that you may use till.exe to parse header files and create standalone .til files which can be made globally available by copying them into <IDADIR>/til. This ...
1
vote
0answers
206 views

How get a full memory dump of a running specific process from kernel mode by driver?

How can i get a full memory dump of a running specific process from kernel mode by driver on windows operation system?
1
vote
1answer
497 views

how to find gsharedinfo from current memory?

How would you scann all sections mapped in the local memory context to find gsharedinfo? gsharedinfo is not exported from user32.dll on Windows server 2008 !!! I would be grateful if you could help ...
1
vote
0answers
559 views

Define new code section in assembly code to compile ELF binary

I defined a new code section in my assembly program, which is going to be compiled into 32-bit ELF binary, on x86. I use the linker scripts to assign a specified address for this new code section, it ...
1
vote
0answers
74 views

Creating shared object library to switch out loaded methods

Is it possible to create a dynamic library libXXX.so with android ndk that has a function that switches out methods in loaded classes in the dvm and call it from any apk ? There are functions within ...
1
vote
2answers
343 views

Does MSVCXXX.dll means that the PE file is compiled by Microsoft Visual C?

While viewing the PE headers and imported functions of some programs designed with visual C. I found that they all include one of these functions: MSVCRT.DLL MSVCR80.DLL MSVCR90.DLL MSVCR100D.DLL ...

1 2 3
4
5
7