33
votes
How to organize vtables in IDA Pro?
This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have ...
- 983
20
votes
How difficult is to decompile C++ file?
Not hard enough!
First of all, if you save the key as a non-encrypted string, a simple strings command will find it and IDA x-ref will even show the reverser where it's used.
If you save the key ...
- 693
14
votes
Accepted
Becoming A Better Reverse Engineer
These suggestions may help. One sure way of becoming a better reverse engineer is to become a better "forward engineer"! Here's what I would suggest:
Examine the assembly output of various ...
- 2,381
13
votes
How difficult is to decompile C++ file?
A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
- 10.5k
11
votes
Accepted
can someone help me with this map format?
You must have been looking at the wrong representation.
Opening the file with a plain graphics viewer shows that it indeed contains "maps", in a 2-byte-per-block format and with a fixed width of 128 ...
- 126
11
votes
Accepted
Why can C# applications be reverse-compiled with variable names while C++ ones can't?
Debug Symbol information is often "stripped off" from C++ binaries. Symbol information stores all user-created names, symbols, and types, bounds, fouction boundary and other function related ...
- 1,427
10
votes
Accepted
How to find the location of the vtable?
This is compiler dependent - the compiler may place the vtable wherever it wants to, as long as it does it consistently. However, in most cases, the vtable pointer is the first element (at offset 0) ...
- 12.6k
10
votes
Accepted
How to recover the exception info from .gcc_except_table and .eh_handle sections?
(I think you may get some extra comments if you use -fverbose-asm.)
Recovering information from these tables is definitely possible, although documentation is scarce and is often present only in the ...
- 34.6k
10
votes
Accepted
mov ecx, arg - How to replicate in C++?
You can either typedef it like this:
// typedef <return-type>(__thiscall* <type-name>)(<ecx>, <stack-1>, <stack-2>);
typedef int(__thiscall* tSomeFunc)(int thisPtr, int ...
- 1,253
9
votes
Accepted
Get section's names and headers for a file using C++
I have extensive experience with parsing the PE on Windows, mainly for use in function interception. Here are the steps you should follow to achieve your goal.
The first step is to find the base ...
- 368
9
votes
Accepted
How to recover information stored in .ctors section?
The .ctors section is a list of pointers terminated with -1 (0xFFFFFFFF), so it does not make sense to disassemble it. If you rearrange the bytes as data, you get:
__CTOR_LIST__: .long 0xffffffff
...
- 34.6k
9
votes
Accepted
Ghidra can't see basic functions in my files?
Visual Studio is inlining the function. You will need to tell VS to not do that:
__declspec(noinline) void someFunction()
{
printf("im scared world, i dont understand.\n");
}
- 336
8
votes
How does new operator internally work in C++?
This is somewhat compiler-specific but in most cases new and delete are basically thin wrappers around malloc and free (regarding the allocation of memory itself). Some additional C++ specifics ...
- 34.6k
7
votes
Accepted
Why two virtual destructors?
According to documentation the first one is base object destructor and the second one is deleting destructor.
Constructors and destructors are simply special cases of <unqualified-name>, where ...
- 7,700
7
votes
Accepted
Find the C++ STL functions in a binary
Libraries like STL or Boost are tricky. Because they're heavily template-based and most of their code is generated at compile time, it's pretty difficult to make FLIRT-style signatures for them. Too ...
- 34.6k
7
votes
Accepted
Reverse Engineering of data structures in games
Side Note: WoW, or any comparable MMORPG, is probably a bad target for your research, because many of those feature various anti-hack, anti-cheat or anti-botting techniques, which will probably detect ...
- 12.6k
7
votes
Accepted
Hash algorithm written in C decompiled with IDA
-1640531527 is hexadecimal '0x9e3779b9'.
This number is used in boost hash function.
The code here in function ub4 hash( k, length, initval) looks similar to yours, at least in the last part.
I think ...
- 7,700
7
votes
Accepted
Visual studio memory allocation reverse engineering
You may want to read up on assembly before attempting to reverse engineer.
esi and edi are pushed on the stack because the compiler thought this routine modifies them. (It is wrong because only edi ...
- 2,274
7
votes
What does a C++ class look like in assembly
As discussed in https://reverseengineering.stackexchange.com/a/5957/1562, it's compiler-dependent (different compilers will generate different machine code and data structures).
However, you may want ...
- 20.4k
7
votes
Accepted
Are vTable pointers always located inside a module?
Note that not every C++ compiler neccesarily uses a vtable pointer at all. For example, the Watcom C++ compiler, 20 years ago, implemented method calls by reserving a function pointer for each method ...
- 12.6k
7
votes
Accepted
What compiler uses a calling convention that uses EAX as the first argument, then pushes onto the stack?
This is probably a program compiled with "Whole Program Optimization" or "Link-time code generation". From MSDN:
When /LTCG is used to link modules compiled with /Og, /O1, /O2, or
/Ox, the ...
- 34.6k
7
votes
Accepted
Finding AddressOfEntryPoint for a 64-bit process
Generally you are doing almost all correct, there are however two simple mistakes.
First and probably most important is here
DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10;
The offset to ...
- 686
6
votes
What is a non-virtual thunk?
These are object virtual table entries used to implement multiple inheritance.
The short story is, the sub instruction is to do with offsetting the correct derived class object size to the virtual ...
6
votes
Accepted
How can a format string vulnerability be used to write a specific string into memory?
It's a lot of questions, here are a few answers:
How can we write something in memory with a format string vulnerability ?
For this, you need to know two specific features used in the printf format ...
- 18k
6
votes
Accepted
Why did the program entry point become 'sub esp, 1C'?
No, this is not a bug. Likely this is because you confuse the executable's entry point address (where Olly breaks) with the address of your main() function (where you expect it to break). You should ...
6
votes
What does the function do while it returns 0?
xor eax, eax
Is the fastest way to zero a register. You will see this everywhere on x86. All x86 ABIs specify that an integer return value is placed in the eax register.
ds is the default segment ...
6
votes
Hash algorithm written in C decompiled with IDA
Some more low-level details:
What is the purpose of (*(_BYTE *)(content + 7) << 24) isn't a byte only 8 bits, so won't it be 0 every time?
In C, shifts implicitly promote the operand to at ...
- 61
6
votes
Accepted
Is there a name for this kind of "obfuscation" for the machine code from C++?
Unfortunately it is not enough code to say exactly what it is, but,
as @0xec said, it looks very much like control flow flattening.
Usually such kind of code transformations are done automatically ...
- 7,700
6
votes
Accepted
Compile C# like C++?
There are a number of options:
C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime.
...
- 176
6
votes
Accepted
How can I access an internal DLL function or piece of data externally?
In case you know the address of your function in the DLL you can call in "C" language via a function pointer. Let us make an example:
Assume you have a function residing in a DLL called "...
- 1,804
Only top scored, non community-wiki answers of a minimum length are eligible