Hot answers tagged

33 votes

How to organize vtables in IDA Pro?

This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have ...
user avatar
  • 983
20 votes

How difficult is to decompile C++ file?

Not hard enough! First of all, if you save the key as a non-encrypted string, a simple strings command will find it and IDA x-ref will even show the reverser where it's used. If you save the key ...
user avatar
  • 693
14 votes
Accepted

Becoming A Better Reverse Engineer

These suggestions may help. One sure way of becoming a better reverse engineer is to become a better "forward engineer"! Here's what I would suggest: Examine the assembly output of various ...
user avatar
  • 2,381
13 votes

How difficult is to decompile C++ file?

A plain text string like this will be visible by looking at the file in a hex editor (like hte or a viewer like xxd or od) or with the Sysinternals strings command or with strings(1) on a Linux/...
user avatar
  • 10.5k
11 votes
Accepted

can someone help me with this map format?

You must have been looking at the wrong representation. Opening the file with a plain graphics viewer shows that it indeed contains "maps", in a 2-byte-per-block format and with a fixed width of 128 ...
user avatar
  • 126
11 votes
Accepted

Why can C# applications be reverse-compiled with variable names while C++ ones can't?

Debug Symbol information is often "stripped off" from C++ binaries. Symbol information stores all user-created names, symbols, and types, bounds, fouction boundary and other function related ...
user avatar
  • 1,427
10 votes
Accepted

How to find the location of the vtable?

This is compiler dependent - the compiler may place the vtable wherever it wants to, as long as it does it consistently. However, in most cases, the vtable pointer is the first element (at offset 0) ...
user avatar
10 votes
Accepted

How to recover the exception info from .gcc_except_table and .eh_handle sections?

(I think you may get some extra comments if you use -fverbose-asm.) Recovering information from these tables is definitely possible, although documentation is scarce and is often present only in the ...
user avatar
  • 34.6k
10 votes
Accepted

mov ecx, arg - How to replicate in C++?

You can either typedef it like this: // typedef <return-type>(__thiscall* <type-name>)(<ecx>, <stack-1>, <stack-2>); typedef int(__thiscall* tSomeFunc)(int thisPtr, int ...
user avatar
  • 1,253
9 votes
Accepted

Get section's names and headers for a file using C++

I have extensive experience with parsing the PE on Windows, mainly for use in function interception. Here are the steps you should follow to achieve your goal. The first step is to find the base ...
user avatar
9 votes
Accepted

How to recover information stored in .ctors section?

The .ctors section is a list of pointers terminated with -1 (0xFFFFFFFF), so it does not make sense to disassemble it. If you rearrange the bytes as data, you get: __CTOR_LIST__: .long 0xffffffff ...
user avatar
  • 34.6k
9 votes
Accepted

Ghidra can't see basic functions in my files?

Visual Studio is inlining the function. You will need to tell VS to not do that: __declspec(noinline) void someFunction() { printf("im scared world, i dont understand.\n"); }
user avatar
  • 336
8 votes

How does new operator internally work in C++?

This is somewhat compiler-specific but in most cases new and delete are basically thin wrappers around malloc and free (regarding the allocation of memory itself). Some additional C++ specifics ...
user avatar
  • 34.6k
7 votes
Accepted

Why two virtual destructors?

According to documentation the first one is base object destructor and the second one is deleting destructor. Constructors and destructors are simply special cases of <unqualified-name>, where ...
user avatar
  • 7,700
7 votes
Accepted

Find the C++ STL functions in a binary

Libraries like STL or Boost are tricky. Because they're heavily template-based and most of their code is generated at compile time, it's pretty difficult to make FLIRT-style signatures for them. Too ...
user avatar
  • 34.6k
7 votes
Accepted

Reverse Engineering of data structures in games

Side Note: WoW, or any comparable MMORPG, is probably a bad target for your research, because many of those feature various anti-hack, anti-cheat or anti-botting techniques, which will probably detect ...
user avatar
7 votes
Accepted

Hash algorithm written in C decompiled with IDA

-1640531527 is hexadecimal '0x9e3779b9'. This number is used in boost hash function. The code here in function ub4 hash( k, length, initval) looks similar to yours, at least in the last part. I think ...
user avatar
  • 7,700
7 votes
Accepted

Visual studio memory allocation reverse engineering

You may want to read up on assembly before attempting to reverse engineer. esi and edi are pushed on the stack because the compiler thought this routine modifies them. (It is wrong because only edi ...
user avatar
  • 2,274
7 votes

What does a C++ class look like in assembly

As discussed in https://reverseengineering.stackexchange.com/a/5957/1562, it's compiler-dependent (different compilers will generate different machine code and data structures). However, you may want ...
user avatar
7 votes
Accepted

Are vTable pointers always located inside a module?

Note that not every C++ compiler neccesarily uses a vtable pointer at all. For example, the Watcom C++ compiler, 20 years ago, implemented method calls by reserving a function pointer for each method ...
user avatar
7 votes
Accepted

What compiler uses a calling convention that uses EAX as the first argument, then pushes onto the stack?

This is probably a program compiled with "Whole Program Optimization" or "Link-time code generation". From MSDN: When /LTCG is used to link modules compiled with /Og, /O1, /O2, or /Ox, the ...
user avatar
  • 34.6k
7 votes
Accepted

Finding AddressOfEntryPoint for a 64-bit process

Generally you are doing almost all correct, there are however two simple mistakes. First and probably most important is here DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10; The offset to ...
user avatar
  • 686
6 votes

What is a non-virtual thunk?

These are object virtual table entries used to implement multiple inheritance. The short story is, the sub instruction is to do with offsetting the correct derived class object size to the virtual ...
6 votes
Accepted

How can a format string vulnerability be used to write a specific string into memory?

It's a lot of questions, here are a few answers: How can we write something in memory with a format string vulnerability ? For this, you need to know two specific features used in the printf format ...
user avatar
  • 18k
6 votes
Accepted

Why did the program entry point become 'sub esp, 1C'?

No, this is not a bug. Likely this is because you confuse the executable's entry point address (where Olly breaks) with the address of your main() function (where you expect it to break). You should ...
user avatar
6 votes

What does the function do while it returns 0?

xor eax, eax Is the fastest way to zero a register. You will see this everywhere on x86. All x86 ABIs specify that an integer return value is placed in the eax register. ds is the default segment ...
user avatar
6 votes

Hash algorithm written in C decompiled with IDA

Some more low-level details: What is the purpose of (*(_BYTE *)(content + 7) << 24) isn't a byte only 8 bits, so won't it be 0 every time? In C, shifts implicitly promote the operand to at ...
user avatar
  • 61
6 votes
Accepted

Is there a name for this kind of "obfuscation" for the machine code from C++?

Unfortunately it is not enough code to say exactly what it is, but, as @0xec said, it looks very much like control flow flattening. Usually such kind of code transformations are done automatically ...
user avatar
  • 7,700
6 votes
Accepted

Compile C# like C++?

There are a number of options: C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime. ...
user avatar
6 votes
Accepted

How can I access an internal DLL function or piece of data externally?

In case you know the address of your function in the DLL you can call in "C" language via a function pointer. Let us make an example: Assume you have a function residing in a DLL called "...
user avatar
  • 1,804

Only top scored, non community-wiki answers of a minimum length are eligible