Hot answers tagged

39 votes

How to organize vtables in IDA Pro?

This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have ...
Ray's user avatar
  • 1,083
12 votes

How difficult is to decompile C++ file?

A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
0xC0000022L's user avatar
  • 10.9k
11 votes
Accepted

can someone help me with this map format?

You must have been looking at the wrong representation. Opening the file with a plain graphics viewer shows that it indeed contains "maps", in a 2-byte-per-block format and with a fixed width of 128 ...
guest's user avatar
  • 126
11 votes
Accepted

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Debug Symbol information is often "stripped off" from C++ binaries. Symbol information stores all user-created names, symbols, and types, bounds, fouction boundary and other function related ...
R4444's user avatar
  • 1,797
9 votes
Accepted

Ghidra can't see basic functions in my files?

Visual Studio is inlining the function. You will need to tell VS to not do that: __declspec(noinline) void someFunction() { printf("im scared world, i dont understand.\n"); }
mumbel's user avatar
  • 441
8 votes

How does new operator internally work in C++?

This is somewhat compiler-specific but in most cases new and delete are basically thin wrappers around malloc and free (regarding the allocation of memory itself). Some additional C++ specifics ...
Igor Skochinsky's user avatar
  • 36.5k
7 votes

What is a non-virtual thunk?

The answer should really state what the difference is between a virtual thunk and a non virtual thunk. They are identical in operation but just have a different name. The thunk for a virtually ...
Lewis Kelsey's user avatar
7 votes
Accepted

Is there a name for this kind of "obfuscation" for the machine code from C++?

Unfortunately it is not enough code to say exactly what it is, but, as @0xec said, it looks very much like control flow flattening. Usually such kind of code transformations are done automatically ...
w s's user avatar
  • 8,448
7 votes
Accepted

What compiler uses a calling convention that uses EAX as the first argument, then pushes onto the stack?

This is probably a program compiled with "Whole Program Optimization" or "Link-time code generation". From MSDN: When /LTCG is used to link modules compiled with /Og, /O1, /O2, or /Ox, the ...
Igor Skochinsky's user avatar
  • 36.5k
7 votes
Accepted

How can I access an internal DLL function or piece of data externally?

In case you know the address of your function in the DLL you can call in "C" language via a function pointer. Let us make an example: Assume you have a function residing in a DLL called "...
josh's user avatar
  • 1,964
7 votes
Accepted

Finding AddressOfEntryPoint for a 64-bit process

Generally you are doing almost all correct, there are however two simple mistakes. First and probably most important is here DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10; The offset to ...
morsisko's user avatar
  • 696
6 votes
Accepted

Compile C# like C++?

There are a number of options: C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime. ...
Hadi Brais's user avatar
6 votes
Accepted

Are some special chars(<>) in function names not supported by windbg/cdb?

they are supported if you add the special escape sequence @!" symbol " make sure you set a resolved breakpoints not an unresolved one and be aware a single address may point to several ...
blabb's user avatar
  • 16.3k
6 votes
Accepted

Decrypting Lua Files

xxtea encrypt with KEY: sxpDM2018 result FightLogic.lua how find the KEY IDA look at Function window press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::...
user29082's user avatar
  • 131
6 votes

IDA and Ghidra Reversing

I can only properly answer your first question: I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find) If your "...
Florian Magin's user avatar
6 votes

C++ Unary equals (unary operator=)

It is rather C++ question, but nonetheless: what you see is an assignment operator for the class QString. It enables you to write things like a = b, where a, b are of QString type. The reason why it ...
bart1e's user avatar
  • 3,369
6 votes
Accepted

Figure out with fopen

It takes the file name, but IDA doesn't recognise it. In this example, IDA interpreted 4-byte string NUL\x00 (4E 55 4C 00) as an offset (address 0x004C554E) in the code. You may force it to interpret ...
bart1e's user avatar
  • 3,369
6 votes
Accepted

Understand/Reverse simple (but good quality) TTS engine

I can't really understand the speech from the Hlasový program at all, but perhaps it is suitable for your needs. I don't have any specific knowledge of this particular software, but based on the time ...
Edward's user avatar
  • 2,521
6 votes
Accepted

What is "nullsub_XXX" in vtable in IDA

Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well nullsub_X IDA ...
NirIzr's user avatar
  • 11.8k
6 votes

How to add STL to Local Types in Ida Pro?

To parse templates you need to use the IDAClang plugin that comes with Ida Pro (I think it's not available with IDA Free). To add a single class/structure definition you can use IDAPython: import ...
overflo's user avatar
  • 268
5 votes
Accepted

Intel PIN: How to access the INS object from inside an analysis function?

You may note that printip is a function pointer, it is lazily called internally by Pin; moreover ins is an automatic variable (it is passed into Instruction from the stack). Consequently, passing &...
Ta Thanh Dinh's user avatar
5 votes
Accepted

Patching a string using DLL injection and OllyDbg

How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))? A process doesn't have a base offset; I believe you mean the base ...
Jason Geffner's user avatar
5 votes

How to recover information stored in .ctors section?

As Igor stated, the .ctors section is a list of function pointers, ending with a sentinel value of 0xffffffff. To see its contents, just do $ objdump -s -j.ctors bar.so But your assembly file only ...
csl's user avatar
  • 151
5 votes
Accepted

How decompilation works?

A thorough but dated theoretical treatment of decompilation can be found in Cristina Cifuentes' 1994 PhD thesis "Reverse Compilation Techniques". The subject matter therein, which includes discussion ...
julian's user avatar
  • 7,108
5 votes
Accepted

Modifying Windows DLLs

Windows has a concept of trusted libraries to hamper attacks like these: Dynamic-Link Library Search Order Citing from the search order: If the DLL is on the list of known DLLs for the version of ...
Nordwald's user avatar
  • 2,896
5 votes
Accepted

Identifying possible structs in C/C++ disassembly

There is nothing strange in structures or objects with large arrays or other structures inside.In addition I see that most of the large offsets are counted from ecx register, which fits to the ...
w s's user avatar
  • 8,448
5 votes

Is there a name for this kind of "obfuscation" for the machine code from C++?

Here's a blog post describing this technique in a little more detail as well as some hints on how to undo it: https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html EDIT ...
Igor Skochinsky's user avatar
  • 36.5k
5 votes
Accepted

Is pointer decryption possible?

pointer encryption There is no such thing. There is only pointer obfuscation. This is essentially how Microsoft markets a couple of functions, and they're pretty open about it from the docs on ...
Evan Carroll's user avatar
  • 1,779
5 votes
Accepted

What are the first 16 bytes in .rodata section?

Trying to provide a more general answer that would hopefully complement this answer linked in the comments. To those who are unsure, the .rodata section in an executable contains all read-only ...
NirIzr's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible