Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [gcc]

GNU Compiler Collection, it includes front ends for C, C++, Objective-C, Fortran, Java, Ada, and Go, as well as libraries for these languages (libstdc++, libgcj,...).

1
vote
0answers
40 views

GCC adds code involving `ecx` in main? [duplicate]

I have two pieces of code, one of which is compiled by me the other of which is supplied in binary-only. The code I am compiling has added instructions pertaining to ecx. What does this code do? The ...
0
votes
2answers
438 views

Can't find the password anywhere in the binary

This is my first post here. I was recently involved in a capture the flag preparation test which involved decompiling an ELF 32-bit LSB executable, Intel 80386 file for Linux compiled with GCC. The ...
2
votes
1answer
303 views

How to override c++ string class with LD_PRELOAD

i am trying to override predefined functions such as strcmp, getenv, etc. i already override some of them using LD_PRELOAD options. but i can't override string class, how can i override c++ string ...
2
votes
1answer
68 views

What does __return_ptr do in IDA?

Let's say I have this program: struct A { int x; }; struct A func1(int z) { struct A result; result.x = z+1; return result; } int main() { return func1(1).x; } When compiling ...
3
votes
1answer
100 views

Basic hello world stack manipulation troubles

I'm a beginner in reverse engineering, and as a beginner I started to read "Reverse Engineering for beginers". Here is the hello world program from the book (taken from chapter 3, page 12) : Now ...
3
votes
4answers
260 views

How to find out if PE executable was compiled with gcc or VisualStudio?

I looked at two ways so far. Both did not convince me in regard to false positives or false negatives: Using strings: How to retrieve the GCC version used to compile a given ELF executable? Using the ...
1
vote
1answer
225 views

How do you compile a C program with missing symbols?

In Learning Linux Binary Analysis by Ryan "elfmaster" O'Neill. On Page 33, the author compiles a program with a symbol reference and no definition, Let's take a look at the source code: _start() ...
0
votes
0answers
45 views

How to call method from other compiled executable

I want to bruteforce an application with something like serial number verification. For performance reason, I want to call only one specific function. I see two possibilities: Export this one ...
-1
votes
1answer
238 views

Shells CTF segfault - wrong address

PicoCTF 2017 Shells I have a binary and source: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/mman.h> #define AMOUNT_OF_STUFF 10 //TODO: Ask IT ...
0
votes
0answers
135 views

gdb: How to determine if a function in a .so is ever used in an app

Newbie question about using gdb: I know how to set a breakpoint for a function in a .so file that is actually called from the app using the .so file. This can be done, for instance, using: b ...
1
vote
2answers
690 views

newbie trying to understand disassembled code

I have been writing small C programs and then disassembling them to try to understand what is actually happening under the hood. I am using mingw-w64 on Windows 7 for my work, and I have run into a ...
3
votes
2answers
1k views

Changing Entrypoint in ELF executable

I wrote some code that does the following: Searches for and finds an offset in a binary file to add code (looks for a sequence of 00s I can overwrite). Then, I change the entrypoint of the ELF to ...
5
votes
2answers
1k views

What is the purpose of these instructions before the main preamble?

I wrote a small C program below: #include <stdlib.h> int sub(int x, int y){ return 2*x+y; } int main(int argc, char ** argv){ int a; a = atoi(argv[1]); return sub(argc,a); } Compiled ...
1
vote
0answers
399 views

How can I control local variable ordering on stack in gcc?

I am writing a reversing challenge where I need to seed a bug. It's important to have a particular ordering of local variable on stack in a method. However, gcc seems to shuffle those around. How can ...
1
vote
1answer
927 views

GCC change the order of variable declaration

I have this very simple piece of code: // test.c int main(){ int a = 0; char b[10]; int c = 0; return 0; } Compiled with gcc (6.2.1): $ gcc -g -o test test.c And analysed with gdb: $ gdb ...
1
vote
1answer
2k views

Passing argument through registers instead of the stack

I'm learning (and re-learning) C and assembly, and I came across a difference between what I've been taught and the actual result I have. Some code: int test(int a, int b){ return a + b; } int ...
1
vote
2answers
586 views

C/C++ to Assembly language

Is there any book or articles related to how C/C++ code is converted to assembly language, I mean common patterns for a specific compiler, etc?
1
vote
1answer
485 views

C++ to assembly, GCC vs CL

I have following C++ code: int main(){ int a = 1; double d = 1.2; return 0; } and get the following assembly using GCC 6.2 -m32: main: lea ecx, [esp+4] and esp, -8 ...
0
votes
1answer
435 views

Fixing weird no-sections embedded ELF binary for decompilation

I recently stumbled upon a weird binary, complied by a "Qualcomm Hexagon" compiler. The ELF binary seems fine, however section tables (section header size and string table index) seem empty. For those ...
0
votes
0answers
168 views

How to pass Obfuscated Elf binary to gcc optimization end

Currently I have a 2000+Line function to reverse engineer with many redundancies and appears to be obfuscated. It their a way to pass to pass this binary to gcc or clang to reassemble it and optimize ...
1
vote
1answer
459 views

Problem to understand execution of payload (shellcode)

I know that there are lot of (good) tutorials regarding this topic, but after reading them, I really cant follow their thoughts (e.g.: Smashing The Stack For Fun And Profit): The problem is that we ...
1
vote
1answer
446 views

What is the difference between these two function prologue instruction sequences?

the test is on 32-bit x86. I compiled the code with gcc 4.2, optimization level o2. I compiled the C code into binary, and then use objdump to disassemble it. Here are two sequences of instructions ...
1
vote
3answers
598 views

Without push instructions [duplicate]

If I pass an argument to a function, it should be translated in assembly language into push something. I coded the following in C: #include <stdio.h> int sum(int a, int b,int c) { int ...
2
votes
1answer
760 views

How to get the information of “how many and which symbols are resolved by linker”?

The test is on 32-bit Linux, x86. With gcc 4.6.3 and GNU ld 2.22. So I am trying to get the information of "how many symbols are resolved by linker" during link time? And how can I list the ...
2
votes
2answers
2k views

How can I write my main function as assembly opcodes in an integer array?

My OS is Windows 7 64-bit and my processor is an Intel Core i7-4700MQ running on the x64 architecture. My program is 32-bit. Recently, I read an article here describing how it is possible and legal ...
1
vote
0answers
77 views

VLAs in C++ - seemingly nonsential compiler code [duplicate]

I've been wondering, why all the hassle with variable length arrays (such as int x[n])? Theoretically, it's just another local variable, so it's merely a matter of subtracting the appropriate value ...
3
votes
1answer
10k views

What is a non-virtual thunk?

In real code I have encountered some "non-virtual thunk" functions: ; `non-virtual thunk to'QTextCodecPlugin::create(QString const&) EXPORT _ZThn8_N16QTextCodecPlugin6createERK7QString ...
4
votes
2answers
3k views

Where the pointer to virtual function table is located?

I used to think that the pointer to the Virtual Function Table (VFT, also Virtual Method Table, VMT) is the very first 32-bit word of the object binary representation. But now I see a VFT whose index ...
3
votes
2answers
3k views

What is operator new(unsigned int)?

In the disassembler output (ARM) I see: BLX _Znwj where BLX is ARM procedure call and _Znwj is demangled as $ c++filt _Znwj operator new(unsigned int) What does that operator new do? Is it ...