39
votes
How to organize vtables in IDA Pro?
This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have ...
- 1,103
12
votes
How difficult is to decompile C++ file?
A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
- 10.9k
11
votes
Accepted
can someone help me with this map format?
You must have been looking at the wrong representation.
Opening the file with a plain graphics viewer shows that it indeed contains "maps", in a 2-byte-per-block format and with a fixed width of 128 ...
- 126
11
votes
Accepted
Why can C# applications be reverse-compiled with variable names while C++ ones can't?
Debug Symbol information is often "stripped off" from C++ binaries. Symbol information stores all user-created names, symbols, and types, bounds, fouction boundary and other function related ...
- 1,807
9
votes
Accepted
Ghidra can't see basic functions in my files?
Visual Studio is inlining the function. You will need to tell VS to not do that:
__declspec(noinline) void someFunction()
{
printf("im scared world, i dont understand.\n");
}
- 441
8
votes
What is a non-virtual thunk?
The answer should really state what the difference is between a virtual thunk and a non virtual thunk. They are identical in operation but just have a different name. The thunk for a virtually ...
- 305
8
votes
How does new operator internally work in C++?
This is somewhat compiler-specific but in most cases new and delete are basically thin wrappers around malloc and free (regarding the allocation of memory itself). Some additional C++ specifics ...
- 36.9k
7
votes
Accepted
Is there a name for this kind of "obfuscation" for the machine code from C++?
Unfortunately it is not enough code to say exactly what it is, but,
as @0xec said, it looks very much like control flow flattening.
Usually such kind of code transformations are done automatically ...
- 8,528
7
votes
Accepted
What compiler uses a calling convention that uses EAX as the first argument, then pushes onto the stack?
This is probably a program compiled with "Whole Program Optimization" or "Link-time code generation". From MSDN:
When /LTCG is used to link modules compiled with /Og, /O1, /O2, or
/Ox, the ...
- 36.9k
7
votes
Accepted
How can I access an internal DLL function or piece of data externally?
In case you know the address of your function in the DLL you can call in "C" language via a function pointer. Let us make an example:
Assume you have a function residing in a DLL called "...
- 1,974
7
votes
Accepted
Finding AddressOfEntryPoint for a 64-bit process
Generally you are doing almost all correct, there are however two simple mistakes.
First and probably most important is here
DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10;
The offset to ...
- 696
6
votes
Accepted
Compile C# like C++?
There are a number of options:
C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime.
...
- 176
6
votes
Accepted
Are some special chars(<>) in function names not supported by windbg/cdb?
they are supported if you add the special escape sequence @!" symbol "
make sure you set a resolved breakpoints not an unresolved one
and be aware a single address may point to several ...
- 16.5k
6
votes
Accepted
Decrypting Lua Files
xxtea encrypt with KEY: sxpDM2018
result
FightLogic.lua
how find the KEY
IDA look at Function window
press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::...
- 131
6
votes
IDA and Ghidra Reversing
I can only properly answer your first question:
I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find)
If your "...
- 1,459
6
votes
C++ Unary equals (unary operator=)
It is rather C++ question, but nonetheless:
what you see is an assignment operator for the class QString. It enables you to write things like a = b, where a, b are of QString type.
The reason why it ...
- 3,429
6
votes
Accepted
Figure out with fopen
It takes the file name, but IDA doesn't recognise it.
In this example, IDA interpreted 4-byte string NUL\x00 (4E 55 4C 00) as an offset (address 0x004C554E) in the code. You may force it to interpret ...
- 3,429
6
votes
Accepted
Understand/Reverse simple (but good quality) TTS engine
I can't really understand the speech from the Hlasový program at all, but perhaps it is suitable for your needs.
I don't have any specific knowledge of this particular software, but based on the time ...
- 2,521
6
votes
Accepted
What is "nullsub_XXX" in vtable in IDA
Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well
nullsub_X
IDA ...
- 11.8k
6
votes
How to add STL to Local Types in Ida Pro?
To parse templates you need to use the IDAClang plugin that comes with Ida Pro (I think it's not available with IDA Free).
To add a single class/structure definition you can use IDAPython:
import ...
- 268
5
votes
Accepted
How decompilation works?
A thorough but dated theoretical treatment of decompilation can be found in Cristina Cifuentes' 1994 PhD thesis "Reverse Compilation Techniques". The subject matter therein, which includes discussion ...
- 7,246
5
votes
Accepted
Modifying Windows DLLs
Windows has a concept of trusted libraries to hamper attacks like these:
Dynamic-Link Library Search Order
Citing from the search order:
If the DLL is on the list of known DLLs for the version of ...
- 2,906
5
votes
Accepted
Identifying possible structs in C/C++ disassembly
There is nothing strange in structures or objects with large arrays or other structures inside.In addition I see that most of the large offsets are counted from ecx register, which fits to the ...
- 8,528
5
votes
Is there a name for this kind of "obfuscation" for the machine code from C++?
Here's a blog post describing this technique in a little more detail as well as some hints on how to undo it:
https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html
EDIT
...
- 36.9k
5
votes
Accepted
Is pointer decryption possible?
pointer encryption
There is no such thing. There is only pointer obfuscation. This is essentially how Microsoft markets a couple of functions, and they're pretty open about it from the docs on ...
- 1,789
5
votes
Accepted
What are the first 16 bytes in .rodata section?
Trying to provide a more general answer that would hopefully complement this answer linked in the comments.
To those who are unsure, the .rodata section in an executable contains all read-only ...
- 11.8k
5
votes
Accepted
Why is fastcall used for replacing thiscall functions in memory instead of cdecl?
This question is a bit confusing.
Both __fastcall and __thiscall share that they use ecx as the first storage point. So either you implicitly say the class pointer will be in ecx (__thiscall) or you ...
- 1,391
5
votes
Accepted
How do I reverse an exe packed with an unknown packer?
You don't throw things at IDA and hope for the best and, as an analyst, you don't relay on automatic tools this much.
That's clearly a sign you need to start doing the heavy lifting.
A packer is ...
- 186
5
votes
Accepted
IDA: Demangled name simplification in idapython
idaapi.get_ea_name(ea, idaapi.GN_SHORT|idaapi.GN_DEMANGLED) seems to return the filtered demangled name.
- 36.9k
Only top scored, non community-wiki answers of a minimum length are eligible