The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

35

Compiler The choice of a compiler has minimal effects on the difficulty to reverse engineer your code. The important things to minimize are all related to information leaks from your code. You want to at least disable any runtime type information (RTTI). The leakage of type information and the simplicity of the instruction set of the virtual machine is one ...


24

I gave a talk at Recon in 2011 ("Practical C++ Decompilation") on this exact topic. Slides and video (mirror) are available. The basic approach is simple: represent classes as structures, and vtables as structures of function pointers. There are some tricks I described that allow you to handle inheritance and different vtables for the classes in the same ...


22

This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the only one I have experience with, and since it provides a hidden compiler switch printing how classes will be layouted in memory which I'm going to use for illustration. As you ...


21

Not hard enough! First of all, if you save the key as a non-encrypted string, a simple strings command will find it and IDA x-ref will even show the reverser where it's used. If you save the key encrypted, a simple breakpoint will let them see the decrypted password. (or understanding the decryption algorithm).


17

Parameters Not only does it depend on the platform but different functions have different calling conventions. The calling convention basically tells you how you know where the arguments are. It says nothing about the local function stack frame layout. It's also extremely important to understand that when a function or method can be proven by the compiler ...


14

In fact, the answer is a bit subtle. According to Barak et al., it is impossible to obfuscate a program. Meaning that you will always leak enough information for an attacker to rebuild a blue-print of the program. On another hand, it is also impossible to build a program that will automatically reverse-engineering any program given as input (it comes from ...


14

It has the fingerprint of an assert: it's called directly after a test; it uses a number -- probably a source line number --, a string which points to a file name -- the source file -- and a string that describes an error condition; it does not return. (Can be inferred because the inspected value would lead to an erronous situation if the called function ...


13

All Hex-Rays macros are defined in <IDA directory>\plugins\defs.h. It's also available at https://github.com/nihilus/hexrays_tools/blob/master/code/defs.h For BYTE3(x): ... #define BYTEn(x, n) (*((_BYTE*)&(x)+n)) ... #define BYTE3(x) BYTEn(x, 3) ... So BYTE3(x) yields (*((_BYTE*)&(x)+3)), which effectively means the fourth byte of the ...


13

A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/FreeBSD etc, for example. Most reverse engineering tools have a separate view for strings, because those are usually exceptionally useful to reverse engineers. Amirag ...


12

These suggestions may help. One sure way of becoming a better reverse engineer is to become a better "forward engineer"! Here's what I would suggest: Examine the assembly output of various compilers. Write test programs of increasing complexity and examine the assembly language output so that you get a sense of what the compiler does for any given high ...


10

You can either typedef it like this: // typedef <return-type>(__thiscall* <type-name>)(<ecx>, <stack-1>, <stack-2>); typedef int(__thiscall* tSomeFunc)(int thisPtr, int arg1, int arg2); tSomeFunc func = (tSomeFunc) 0xBAADC0DE; // this is how you call it func(/* this */ 0x123, /* arg1 */ 1, /* arg2 */ arg2); Or directly call ...


9

If the binary itself has RTTI info compiled in it then you can get at least the names for the vftables, and to some degree a class/struct hierarchy. For Windows x86 you can use my IDA plug-in "Class Informer". Also see for reference Reversing Microsoft Visual C++ Part II: Classes, Methods and RTTI by igorsk. Otherwise AFAIK (and know the area well) I doubt ...


8

opening a vc commandprompt using start->programs->vc->vc command prompt Setting environment for using Microsoft Visual Studio 2010 x86 tools. creating a tempdir in desktop for compiling and linking C:\Program Files\Microsoft Visual Studio 10.0\VC>cd "c:\Documents and Settings\Admin\Desktop" C:\Documents and Settings\Admin\Desktop>md pran C:...


8

It seems that different answers correspond to different interpretations of the question. A C++ compiler creates a binary from source code. A C++ decompiler would create source code from the binary. It's not possible, generally, to recreate the source (comments, macro definitions and local variable names, for example often don't exist in any form in the ...


8

Some options which may or may not be applicable depending on your needs: Avoid using strings to leak out interesting information when possible. For example if you are using strings to display error information or logging information, this can give any reverse engineer valuable details as to what might be going on in your application. Instead replace these ...


8

TL;DR you can call anything, locating the right part of code is the hard part. export table If you mean 'just as Windows does', then you mean the functions of the DLL that are available to the others, ie the exported ones? in this case, you need to parse the export table - check pefile for a readable and reliable implementation. locating any function IDA ...


8

The area you're looking at is something specific to the program; it's not part of Windows structures. The value at fs:[0x2C] is the TLS array - array of pointers to the thread-specific blocks of variables somewhere in the program's memory. Here's how a typical TLS access to a __declspec(thread) variable looks like: mov eax, DWORD PTR __tls_index ; load ...


8

One thing you need to keep in mind is that code in your process and the code in the target process reside in different address spaces. So any address in your program is not necessary valid in the target process and vice versa. This means the code that you inject cannot many any assumptions about addresses of functions or variables. Even your inject function'...


8

The .ctors section is a list of pointers terminated with -1 (0xFFFFFFFF), so it does not make sense to disassemble it. If you rearrange the bytes as data, you get: __CTOR_LIST__: .long 0xffffffff __CTOR_END__: .long 0x00000000 So, for whatever reason, the resulting exe does not actually use the .ctors section. I suspect the linker instead placed the ...


8

Side Note: WoW, or any comparable MMORPG, is probably a bad target for your research, because many of those feature various anti-hack, anti-cheat or anti-botting techniques, which will probably detect what you're doing. I'm far from being an expert on this myself, but i've disassembled and tried to understand a 20 year old game as a hobby project recently. ...


7

The reason why there aren't engines to hook the end of a function is because it's hard to determine where that is, or if it even exists. A function has a single entry point, but it can have multiple exit points, including none at all (consider exit()). The exit point can have multiple types, too - return, throw(), longjmp(), C++EH, etc. The general idea to ...


7

You cannot prevent reverse engineering. You can make it more or less harder but you cannot prevent it. No. Update Ok, as the author updated it with a more clearer question... this is what one can do: Strip symbols from the binaries. At the very least. Obfuscate the code. This may help: https://stackoverflow.com/questions/4111808/c-c-compiler-generating-...


7

Libraries like STL or Boost are tricky. Because they're heavily template-based and most of their code is generated at compile time, it's pretty difficult to make FLIRT-style signatures for them. Too much depends on the specific compiler, build options, optimization settings and so on, so unless you match them pretty closely when generating signatures, you're ...


7

This is compiler dependent - the compiler may place the vtable wherever it wants to, as long as it does it consistently. However, in most cases, the vtable pointer is the first element (at offset 0) of the generated structure. class test { int a; int b; test() { ...; } ~test() { ...; } void somefunc() { ...; } int c; ...


7

(I think you may get some extra comments if you use -fverbose-asm.) Recovering information from these tables is definitely possible, although documentation is scarce and is often present only in the code which parses them. The .eh_frame layout is described briefly in the LSB documentation. Ian Lance Taylor (author of the gold linker) also made some blog ...


7

-1640531527 is hexadecimal '0x9e3779b9'. This number is used in boost hash function. The code here in function ub4 hash( k, length, initval) looks similar to yours, at least in the last part. I think that it is a good point to start googling from. As far as I can say it is probably intermediate variant(lookup2) of Jenkins Hash


7

You may want to read up on assembly before attempting to reverse engineer. esi and edi are pushed on the stack because the compiler thought this routine modifies them. (It is wrong because only edi is used. Still, better safe than sorry.) mov eax,0cccccccch moves the value 0CCCCCCCCh into register eax. Which is actually kind of self-explanatory. That ...


7

Note that not every C++ compiler neccesarily uses a vtable pointer at all. For example, the Watcom C++ compiler, 20 years ago, implemented method calls by reserving a function pointer for each method within the object itself; the new operator initialized each of these function pointers separately, every time it generated a new object. The very idea of the ...


7

This is somewhat compiler-specific but in most cases new and delete are basically thin wrappers around malloc and free (regarding the allocation of memory itself). Some additional C++ specifics regarding new expressions and the sequence of construction/destructions of classes and their members are described in the C++ standard (a nice summary is available at ...


7

This is probably a program compiled with "Whole Program Optimization" or "Link-time code generation". From MSDN: When /LTCG is used to link modules compiled with /Og, /O1, /O2, or /Ox, the following optimizations are performed: Cross-module inlining Interprocedural register allocation (64-bit operating systems only) Custom calling ...


Only top voted, non community-wiki answers of a minimum length are eligible