Skip to main content

Questions tagged [msvc]

Microsoft Visual C/C++ Compiler

Filter by
Sorted by
Tagged with
0 votes
1 answer
50 views

DLL exports same function with multiple names

When ntdll.dll is loaded in x64dbg, I see that there can be multiple symbols at the same address. For example; As far as I know, there is no way to achieve something like this using regular msvc ...
yasar's user avatar
  • 103
0 votes
2 answers
100 views

Seemingly useless instruction inside function body

I am trying to reverse RtlInitUnicodeStringEx from ntdll.dll as an exercise to myself. Here is dissambled version from x64dbg. I was able to produce almost exactly the same binary from my own code, ...
yasar's user avatar
  • 103
0 votes
1 answer
132 views

Where to find the Visual C++ 6.0 CRT Source Code?

I want to see MSVCRT's implementation details for the old Microsoft Visual Studio C++ 6.0 compiler. On newer Visual Studio versions, it is located in /VC/crt/src/ directory, but there is no such ...
void_17's user avatar
  • 33
2 votes
1 answer
829 views

How to search a sequence of instructions in Ghidra?

I'd like to identify in Ghidra a specific sequence of instructions, which I get from MSVC Debug in Visual Studio compiling my own function: What I'm looking for so is (for the same DLL, decompiled in ...
markzzz's user avatar
  • 87
2 votes
0 answers
74 views

How to deal with msvc runtime integrity?

After any type of patching image code the app cannot properly initialize the window specifically on the user32!CreateWindowExA call. PDB file shows it's vc2010\x64\Release. I'm actually newbie in ...
Andrei Nevsky's user avatar
1 vote
1 answer
111 views

x86 weird register call

I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported ...
Madghostek's user avatar
1 vote
0 answers
156 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
Curious User's user avatar
2 votes
2 answers
3k views

Understanding a C code including CRT functions, decompiled with Ghidra

I am trying to learn software reverse engineering with Ghidra, though I have never used Visual Studio Compilers or the C runtime (CRT). I have a piece of decompiled C code: <typeName> <...
Foad's user avatar
  • 189
1 vote
1 answer
222 views

Can a MSVC class have a deletion destructor without a vftable?

I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays: struct Referencable { int m_refs; }; struct Buffer : Referencable { void* m_pData; }; ...
Ray's user avatar
  • 1,103
0 votes
1 answer
63 views

One class with different sizes

After looking at some basic examples of how C++ classes are compiled by MSVC, I tried to apply the knowledge to a DLL I'm working on. While searching for a class to start with, I came across ...
mindoverflow's user avatar
1 vote
1 answer
55 views

What's the meaning of @ tag on proxy dll?

In proxy dll in .def file I can see the following notation: _CreateFrameInfo=PROXY__CreateFrameInfo @1 Others use in the following format: _AIL_3D_position@16 = vcruntime140_._AIL_3D_position@16 ...
Irbis77's user avatar
  • 328
1 vote
0 answers
46 views

Weird x86 function calling convention [duplicate]

I have come across some weird function. It's in an x86 LE Windows executable compiled with Visual Studio and linking to v100 runtime. The function seems to be an __stdcall as it ends with a move into ...
TPlant's user avatar
  • 111
1 vote
2 answers
2k views

STL Data Structures Hex-Rays

We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure. For example, msvc - ...
Martin Brooker's user avatar
0 votes
0 answers
244 views

Some more questions related to C++ exceptions (catchHigh)

I've came up with the most convoluted example but still can't find the purpose of the catchHigh field. I find it that the right handler can be selected simply by looking at the tryblock map from start ...
rec's user avatar
  • 475
1 vote
1 answer
330 views

What code produces FuncInfoV1 with zero TryBlocks and zero UnwindMap?

Topic is C++ exceptions internal representation in WIndows x86 binaries compiled with msvc. I've found a code that straight up doesn't have nothing (all fields of FuncInfo zero) except the EHFlags ...
rec's user avatar
  • 475
2 votes
1 answer
407 views

What does state mean in unwinding?

I'm looking at UnwindMapEntry. Here is it's declaration: // // UnwindMapEntry - Description of each state transition for unwinding // the stack (i.e. calling destructors). // // The unwind map is an ...
rec's user avatar
  • 475
2 votes
1 answer
179 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
rec's user avatar
  • 475
4 votes
1 answer
586 views

MSVC Destructors with 2 Arguments

I'm reversing a program which I assume was compiled with MSVC. It's seeming like the first entry in each vtable is the class' destructor. However, when I look at the disassembly and decompilation, it ...
sasschary's user avatar
2 votes
2 answers
380 views

undname.exe: invalid undecorated names

I've discovered undname.exe today and tried it on several functions. I got some incorrect results and I'm wondering why. I see two main reasons that could do that: The mangling can change between ...
Stud's user avatar
  • 197
0 votes
1 answer
1k views

Class definition

I have a complicated question to ask so I will try my best to be clear. I have this binary I am trying to reverse that came with a pdb file. I have dumped the compilands of the binary to begin with. ...
ilias kavalis's user avatar
3 votes
2 answers
2k views

How can I demangle the name in an RTTI Type Descriptor?

I'm currently browsing through RTTI information available in an MSVC++2003 executable (writing an IDAPython script to recreate structs for the class hierarchy). Apparently, as visualized here, the ...
Ray's user avatar
  • 1,103
-1 votes
1 answer
133 views

Why would MSVC pass a constant "2" for an unused this parameter?

Hex-Rays decompiled (with the assistance of pdb symbols) a piece of code as such: XPerfAddIn::CFramesInfoSource::MatchEventDescriptor( (XPerfAddIn::CFramesInfoSource *)2 And by my following of the ...
Zhentar's user avatar
  • 193
8 votes
2 answers
2k views

Split variable in Hexrays decompiler?

With Microsoft Visual C++ executables, I often run into decompilations like this: void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength) { Pbdf *pbdf; // esi pbdf = pbdfOrLength; ...
Ray's user avatar
  • 1,103
2 votes
3 answers
2k views

Help reversing code which uses ATL::CStringT

I'm attempting to learn reversing techniques using IDA on an exe built with VC/MFC, and could use a little initial help learning some patterns for simplifying the decompiled code. IDA found ...
Chris Olsen's user avatar
3 votes
1 answer
450 views

Why would a vtable reference the same function multiple times?

I decompile a VC++ application in IDA 7, and I often find vftables referencing the same function multiple times, like the one I called "Object__pure" here, part of a "heavy-base" Object class ...
Ray's user avatar
  • 1,103
1 vote
1 answer
178 views

How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? [duplicate]

A C++ program I'm looking at appears to have been compiled with MSVC. It links to MSVCR100.dll, contains MSVC's security cookie code and uses the Microsoft mangling scheme. However, one of the ...
Ben Jaguar Marshall's user avatar
3 votes
0 answers
2k views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
Tadas S's user avatar
  • 131
1 vote
1 answer
75 views

What is the general term used for these pictured symbols?

I see these in VC++ compiled programs often. However, I've searched for several of them, such as AVCCHKBOX@@ and AVCDLC_NAME@@ to no avail. What are these called?
the_endian's user avatar
  • 1,870
2 votes
1 answer
428 views

Why is otkloadr.WRAssembly.1 reference present in a office file?

I was working with a RTF file and I found the string "otkloadr.WRAssembly.1" present inside the file in plain sight. I know that many exploits use this for loading the msvcr71.dll (non-ASLR module). ...
rebel87's user avatar
  • 391
1 vote
1 answer
256 views

Why does MSVC x64 Compiler load addresses like this?

Normally, in x86, to load a pointer to a null-terminated string you would use MOV EDX, OFFSET ds:mystring In x64, however, I noticed that the compiler does it like this lea rdx, OFFSET FLAT:$...
Cyrex Cyrex's user avatar
2 votes
1 answer
1k views

vTable size calculation (for MSVC)

I made some PE analysis script. One part is virtual functions extraction, I implemented vTables lookup using this schema. Actual algorithm of lookup is not important part of question. I don't know ...
ST3's user avatar
  • 849