36
Compiler
The choice of a compiler has minimal effects on the difficulty to reverse engineer your code. The important things to minimize are all related to information leaks from your code. You want to at least disable any runtime type information (RTTI). The leakage of type information and the simplicity of the instruction set of the virtual machine is one ...
28
This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have experience with, and since it provides a hidden compiler switch printing how classes will be layouted in memory which I'm going to use for illustration.
As you might ...
24
I gave a talk at Recon in 2011 ("Practical C++ Decompilation") on this exact topic. Slides and video (mirror) are available.
The basic approach is simple: represent classes as structures, and vtables as structures of function pointers. There are some tricks I described that allow you to handle inheritance and different vtables for the classes in the same ...
20
Not hard enough!
First of all, if you save the key as a non-encrypted string, a simple strings command will find it and IDA x-ref will even show the reverser where it's used.
If you save the key encrypted, a simple breakpoint will let them see the decrypted password. (or understanding the decryption algorithm).
17
Parameters
Not only does it depend on the platform but different functions have different calling conventions. The calling convention basically tells you how you know where the arguments are. It says nothing about the local function stack frame layout.
It's also extremely important to understand that when a function or method can be proven by the compiler ...
14
In fact, the answer is a bit subtle.
According to Barak et al., it is impossible to obfuscate a program. Meaning that you will always leak enough information for an attacker to rebuild a blue-print of the program.
On another hand, it is also impossible to build a program that will automatically reverse-engineering any program given as input (it comes from ...
14
All Hex-Rays macros are defined in <IDA directory>\plugins\defs.h. It's also available at https://github.com/nihilus/hexrays_tools/blob/master/code/defs.h
For BYTE3(x):
...
#define BYTEn(x, n) (*((_BYTE*)&(x)+n))
...
#define BYTE3(x) BYTEn(x, 3)
...
So BYTE3(x) yields (*((_BYTE*)&(x)+3)), which effectively means the fourth byte of the ...
14
It has the fingerprint of an assert:
it's called directly after a test;
it uses a number -- probably a source line number --, a string which points to a file name -- the source file -- and a string that describes an error condition;
it does not return. (Can be inferred because the inspected value would lead to an erronous situation if the called function ...
14
These suggestions may help. One sure way of becoming a better reverse engineer is to become a better "forward engineer"! Here's what I would suggest:
Examine the assembly output of various compilers. Write test programs of increasing complexity and examine the assembly language output so that you get a sense of what the compiler does for any given high ...
13
A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/FreeBSD etc, for example. Most reverse engineering tools have a separate view for strings, because those are usually exceptionally useful to reverse engineers. Amirag ...
11
You must have been looking at the wrong representation.
Opening the file with a plain graphics viewer shows that it indeed contains "maps", in a 2-byte-per-block format and with a fixed width of 128 bytes/64 blocks:
The first 514 bytes seem to contain some other kind of data but after that every two bytes form one single map block. You'll have to compare ...
10
You can either typedef it like this:
// typedef <return-type>(__thiscall* <type-name>)(<ecx>, <stack-1>, <stack-2>);
typedef int(__thiscall* tSomeFunc)(int thisPtr, int arg1, int arg2);
tSomeFunc func = (tSomeFunc) 0xBAADC0DE;
// this is how you call it
func(/* this */ 0x123, /* arg1 */ 1, /* arg2 */ arg2);
Or directly call ...
9
One thing you need to keep in mind is that code in your process and the code in the target process reside in different address spaces. So any address in your program is not necessary valid in the target process and vice versa.
This means the code that you inject cannot make any assumptions about addresses of functions or variables. Even your inject function'...
9
If the binary itself has RTTI info compiled in it then you can get at least the names for the vftables, and to some degree a class/struct hierarchy.
For Windows x86 you can use my IDA plug-in "Class Informer".
Also see for reference Reversing Microsoft Visual C++ Part II: Classes, Methods and RTTI by igorsk.
Otherwise AFAIK (and know the area well) I doubt ...
9
Visual Studio is inlining the function. You will need to tell VS to not do that:
__declspec(noinline) void someFunction()
{
printf("im scared world, i dont understand.\n");
}
8
The reason why there aren't engines to hook the end of a function is because it's hard to determine where that is, or if it even exists. A function has a single entry point, but it can have multiple exit points, including none at all (consider exit()).
The exit point can have multiple types, too - return, throw(), longjmp(), C++EH, etc.
The general idea to ...
8
Some options which may or may not be applicable depending on your needs:
Avoid using strings to leak out interesting information when possible. For example if you are using strings to display error information or logging information, this can give any reverse engineer valuable details as to what might be going on in your application. Instead replace these ...
8
TL;DR you can call anything, locating the right part of code is the hard part.
export table
If you mean 'just as Windows does', then you mean the functions of the DLL that are available to the others, ie the exported ones? in this case, you need to parse the export table - check pefile for a readable and reliable implementation.
locating any function
IDA
If ...
8
The area you're looking at is something specific to the program; it's not part of Windows structures.
The value at fs:[0x2C] is the TLS array - array of pointers to the thread-specific blocks of variables somewhere in the program's memory. Here's how a typical TLS access to a __declspec(thread) variable looks like:
mov eax, DWORD PTR __tls_index ; load ...
8
It seems that different answers correspond to different interpretations of the question. A C++ compiler creates a binary from source code. A C++ decompiler would create source code from the binary.
It's not possible, generally, to recreate the source (comments, macro definitions and local variable names, for example often don't exist in any form in the ...
8
opening a vc commandprompt using
start->programs->vc->vc command prompt
Setting environment for using Microsoft Visual Studio 2010 x86 tools.
creating a tempdir in desktop for compiling and linking
C:\Program Files\Microsoft Visual Studio 10.0\VC>cd "c:\Documents and Settings\Admin\Desktop"
C:\Documents and Settings\Admin\Desktop>md pran
C:...
8
This is compiler dependent - the compiler may place the vtable wherever it wants to, as long as it does it consistently. However, in most cases, the vtable pointer is the first element (at offset 0) of the generated structure.
class test {
int a;
int b;
test() { ...; }
~test() { ...; }
void somefunc() { ...; }
int c;
...
8
I have extensive experience with parsing the PE on Windows, mainly for use in function interception. Here are the steps you should follow to achieve your goal.
The first step is to find the base address of the image loaded into memory. This step will be different depending on if the executable has or hasn't been mapped into memory, but the basic idea will ...
8
The .ctors section is a list of pointers terminated with -1 (0xFFFFFFFF), so it does not make sense to disassemble it. If you rearrange the bytes as data, you get:
__CTOR_LIST__: .long 0xffffffff
__CTOR_END__: .long 0x00000000
So, for whatever reason, the resulting exe does not actually use the .ctors section. I suspect the linker instead placed the ...
8
(I think you may get some extra comments if you use -fverbose-asm.)
Recovering information from these tables is definitely possible, although documentation is scarce and is often present only in the code which parses them.
The .eh_frame layout is described briefly in the LSB documentation. Ian Lance Taylor (author of the gold linker) also made some blog ...
8
Side Note: WoW, or any comparable MMORPG, is probably a bad target for your research, because many of those feature various anti-hack, anti-cheat or anti-botting techniques, which will probably detect what you're doing.
I'm far from being an expert on this myself, but i've disassembled and tried to understand a 20 year old game as a hobby project recently. ...
8
This is somewhat compiler-specific but in most cases new and delete are basically thin wrappers around malloc and free (regarding the allocation of memory itself). Some additional C++ specifics regarding new expressions and the sequence of construction/destructions of classes and their members are described in the C++ standard (a nice summary is available at ...
7
You cannot prevent reverse engineering. You can make it more or less harder but you cannot prevent it. No.
Update
Ok, as the author updated it with a more clearer question... this is what one can do:
Strip symbols from the binaries. At the very least.
Obfuscate the code. This may help: https://stackoverflow.com/questions/4111808/c-c-compiler-generating-...
7
Libraries like STL or Boost are tricky. Because they're heavily template-based and most of their code is generated at compile time, it's pretty difficult to make FLIRT-style signatures for them. Too much depends on the specific compiler, build options, optimization settings and so on, so unless you match them pretty closely when generating signatures, you're ...
7
According to documentation the first one is base object destructor and the second one is deleting destructor.
Constructors and destructors are simply special cases of <unqualified-name>, where the final <unqualified-name> of a nested name is replaced by one of the following:
<ctor-dtor-name> ::= C1 # complete object constructor
...
Only top voted, non community-wiki answers of a minimum length are eligible
