39
votes
How to organize vtables in IDA Pro?
This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have ...
- 1,083
12
votes
How difficult is to decompile C++ file?
A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
- 10.9k
11
votes
Accepted
can someone help me with this map format?
You must have been looking at the wrong representation.
Opening the file with a plain graphics viewer shows that it indeed contains "maps", in a 2-byte-per-block format and with a fixed width of 128 ...
- 126
11
votes
Accepted
Why can C# applications be reverse-compiled with variable names while C++ ones can't?
Debug Symbol information is often "stripped off" from C++ binaries. Symbol information stores all user-created names, symbols, and types, bounds, fouction boundary and other function related ...
- 1,767
10
votes
Accepted
mov ecx, arg - How to replicate in C++?
You can either typedef it like this:
// typedef <return-type>(__thiscall* <type-name>)(<ecx>, <stack-1>, <stack-2>);
typedef int(__thiscall* tSomeFunc)(int thisPtr, int ...
- 1,283
9
votes
Accepted
Ghidra can't see basic functions in my files?
Visual Studio is inlining the function. You will need to tell VS to not do that:
__declspec(noinline) void someFunction()
{
printf("im scared world, i dont understand.\n");
}
- 441
8
votes
How does new operator internally work in C++?
This is somewhat compiler-specific but in most cases new and delete are basically thin wrappers around malloc and free (regarding the allocation of memory itself). Some additional C++ specifics ...
- 36.2k
7
votes
Accepted
Are vTable pointers always located inside a module?
Note that not every C++ compiler neccesarily uses a vtable pointer at all. For example, the Watcom C++ compiler, 20 years ago, implemented method calls by reserving a function pointer for each method ...
- 12.9k
7
votes
What does a C++ class look like in assembly
As discussed in https://reverseengineering.stackexchange.com/a/5957/1562, it's compiler-dependent (different compilers will generate different machine code and data structures).
However, you may want ...
- 20.6k
7
votes
Accepted
Is there a name for this kind of "obfuscation" for the machine code from C++?
Unfortunately it is not enough code to say exactly what it is, but,
as @0xec said, it looks very much like control flow flattening.
Usually such kind of code transformations are done automatically ...
- 8,353
7
votes
Accepted
What compiler uses a calling convention that uses EAX as the first argument, then pushes onto the stack?
This is probably a program compiled with "Whole Program Optimization" or "Link-time code generation". From MSDN:
When /LTCG is used to link modules compiled with /Og, /O1, /O2, or
/Ox, the ...
- 36.2k
7
votes
Accepted
How can I access an internal DLL function or piece of data externally?
In case you know the address of your function in the DLL you can call in "C" language via a function pointer. Let us make an example:
Assume you have a function residing in a DLL called "...
- 1,964
7
votes
Accepted
Finding AddressOfEntryPoint for a 64-bit process
Generally you are doing almost all correct, there are however two simple mistakes.
First and probably most important is here
DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10;
The offset to ...
- 696
6
votes
What is a non-virtual thunk?
The answer should really state what the difference is between a virtual thunk and a non virtual thunk. They are identical in operation but just have a different name. The thunk for a virtually ...
- 285
6
votes
Accepted
Compile C# like C++?
There are a number of options:
C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime.
...
- 176
6
votes
Accepted
Are some special chars(<>) in function names not supported by windbg/cdb?
they are supported if you add the special escape sequence @!" symbol "
make sure you set a resolved breakpoints not an unresolved one
and be aware a single address may point to several ...
- 16.2k
6
votes
Accepted
Decrypting Lua Files
xxtea encrypt with KEY: sxpDM2018
result
FightLogic.lua
how find the KEY
IDA look at Function window
press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::...
- 131
6
votes
IDA and Ghidra Reversing
I can only properly answer your first question:
I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find)
If your "...
- 1,401
6
votes
C++ Unary equals (unary operator=)
It is rather C++ question, but nonetheless:
what you see is an assignment operator for the class QString. It enables you to write things like a = b, where a, b are of QString type.
The reason why it ...
- 3,369
6
votes
Accepted
Figure out with fopen
It takes the file name, but IDA doesn't recognise it.
In this example, IDA interpreted 4-byte string NUL\x00 (4E 55 4C 00) as an offset (address 0x004C554E) in the code. You may force it to interpret ...
- 3,369
6
votes
Accepted
Understand/Reverse simple (but good quality) TTS engine
I can't really understand the speech from the Hlasový program at all, but perhaps it is suitable for your needs.
I don't have any specific knowledge of this particular software, but based on the time ...
- 2,521
6
votes
Accepted
What is "nullsub_XXX" in vtable in IDA
Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well
nullsub_X
IDA ...
- 11.7k
6
votes
How to add STL to Local Types in Ida Pro?
To parse templates you need to use the IDAClang plugin that comes with Ida Pro (I think it's not available with IDA Free).
To add a single class/structure definition you can use IDAPython:
import ...
- 258
5
votes
How to recover information stored in .ctors section?
As Igor stated, the .ctors section is a list of function pointers, ending with a sentinel value of 0xffffffff. To see its contents, just do
$ objdump -s -j.ctors bar.so
But your assembly file only ...
- 151
5
votes
Accepted
Writing an exploit for sample-application
Why is it not working. This example is basically from an older book I'm reading. But theoretically it should work so I think....
It's because you're overwriting the return address on the stack ...
- 20.6k
5
votes
Accepted
Patching a string using DLL injection and OllyDbg
How do I find the base offset of process (I assume I can do in the DLL using something like GetModuleHandle("HackMe.exe"))?
A process doesn't have a base offset; I believe you mean the base ...
- 20.6k
5
votes
Accepted
Intel PIN: How to access the INS object from inside an analysis function?
You may note that printip is a function pointer, it is lazily called internally by Pin; moreover ins is an automatic variable (it is passed into Instruction from the stack). Consequently, passing &...
- 1,410
5
votes
Accepted
How decompilation works?
A thorough but dated theoretical treatment of decompilation can be found in Cristina Cifuentes' 1994 PhD thesis "Reverse Compilation Techniques". The subject matter therein, which includes discussion ...
- 7,058
5
votes
Accepted
Modifying Windows DLLs
Windows has a concept of trusted libraries to hamper attacks like these:
Dynamic-Link Library Search Order
Citing from the search order:
If the DLL is on the list of known DLLs for the version of ...
- 2,896
Only top scored, non community-wiki answers of a minimum length are eligible