11
Debug Symbol information is often "stripped off" from C++ binaries. Symbol information stores all user-created names, symbols, and types, bounds, fouction boundary and other function related metadata information (it is generally stored according to a popular and standardized "dwarf" format which is widely used and employed in modern ...
5
Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well
nullsub_X
IDA makes a minimal effort of providing meaningful, yet general, names for functions according to their implementation by adding a prefix or name for certain types ...
4
Two possibilities:
Patch the call instruction to point to a destination of your choosing, such as a "code cave" between the end of the .text section and the subsequent section. Write your function there, or jmp to your DLL / a piece of allocated memory containing your function.
Overwrite the IAT entry for glfwCreateWindow, and point it to your new ...
3
I was able to work this one out.
The decompiler was not detecting the correct call parameter counts for the >> and << operators of cin and cout.
For example:
int __thiscall std__basic_istream_char_std__char_traits_char____operator__(_DWORD, _DWORD, _DWORD)
Is the detected signature of the >> operator.
However, reviewing the C++ reference, ...
3
If you compare pseudocode returned by decompiler with your own C code you will notice one very important difference - in decompiler's output it is merely a comment, but it's very important. I'm talking about following lines:
int v7; // [sp+10h] [bp-42Ch]@1
char v8; // [sp+14h] [bp-428h]@1
int v9; ...
3
IDA knew that there was a struct named ComputeService::RPC due to a mangled name containing a reference to it -- for example, a mangled name for the function shown in your question. However, IDA did not have a struct declaration for it, so it created an empty struct -- you can tell this because the Description field for that entry simply says struct. If IDA ...
2
Instruction encoding and decoding is one of the least user-friendly parts of the SDK. Since they have to support so many processor architectures with the same set of data types, they basically have to get creative with how they store information about the operands. It does not always make logical sense, but it really doesn't have to -- there are few ...
2
an indirect call , use of ecx as the this pointer etc indicates it is a virtual function call
lets take the example you quoted in your query modify it a little and see the disassembly
contents of directory pre compilation
D:\virt>dir /b
virt.cpp
source from example duly modified a bit
D:\virt>type virt.cpp
01 #include <iostream>
02 class Animal {...
2
since this is tangentially related to query
I am adding this as another answer instead of editing the first answer
it appears the code in question possibly ignores compiler warnings
<source>: In function 'int main()':
<source>:11:40: warning: ISO C++ forbids converting a string constant to 'char*' [-Wwrite-strings]
11 | std::cout << ...
2
Maybe it is the temperature in Kelvin: 311 - 80/2 = 217K = -2.15°C
Or the offset is different than 80/2. A 16-bit floating-poitn format, especially a different one from IEEE-754 is highly unlikely. Such measurement chips are not more but simple ADCs, they lack the capabilities to convert their reading to floating-point.
To be sure, you would have to take ...
2
In the comment to your original question, I mentioned that it might be a boost::fusion::map, and asked whether there were two bool values at +0x14 and +0x15. You then updated your post with an image showing bool-looking values at those locations.
I think my original guess was correct. It seems to be a boost::fusion::container::map. For MSVC's STL ...
2
As Paweł Łukasik point out, it looks like RC4 indeed.
That's especially true for the KSA that you can immediately recognize:
local_14 = 0;
while (local_14 < 0x100) {
local_12c[local_14] = (byte)local_14;
local_14 = local_14 + 1;
}
If you rename the variables by keeping in mind that this is a Key-Scheduling Algorithm, you end up with the ...
2
If all you're trying to do is replicate what the SysInternals project does, the strings2 project you linked does that and should suit your purposes. The x86/x64 thing is only for a special extraction mode they added, which is separate from the functionality of SysInternals Strings.
On the other hand, if you do need to extract strings stored more sneakily (...
2
You cannot prevent patching. There are ways to make reverse engineering harder, but the checksum approach is not the best way. There are way more advanced methods, that cannot be compared to a custom-made antitampering routine.
Even those advanced methods become eventually studied and cracked.
Either you have to rely on commercial protections (maybe ...
2
The problem seems to be in the source address calculation:
&ImportDescriptor.Name + (uintptr_t)ModuleBase
This adds the address of a local variable (which is on the stack) to the image base, so the result is probably some non-existent address.
You should add its value, which is an RVA, to the image base. I.e. something like this:
memcpy(&LibraryName,...
2
Is there a way to check what are the fields inside this struct?
The old fashion way. Follow that pointer around through the assembly and see what offsets are used and how. If you can find where it's created, you can know it's total size. If you can debug the program live you can set watch points and see what data actually gets put into each offset. The size ...
2
The function's name isn't struct dynamic_array. The function's name is Mesh::CalculateBoneBindPoseBounds.
The function accepts an argument of type struct dynamic_array<...>.
There's no function named dynamic_array, as it's simply as structure defined within the binary. The name does imply we're dealing with an std::vector-like object, so I'd start with ...
2
that is a negative number
C:\>python -c "print(hex(0xffff98b4-2**32))"
-0x674c
or in other words
C:\>python -c "print(hex(2**32 - 0x674c))"
0xffff98b4
1
It's a compiler optimization used to implement switch statements that have many cases leading to one location. Note that the weird output is not Hex-Rays' doing, but rather, a more-or-less direct translation of what's in the assembly language. You didn't show the assembly for your snippet, but here's similar disassembly from a database I have open:
.text:...
1
So, it turns out that if you're testing an IAT hook on a driver, the driver must be compiled in the release mode rather than in the debug one.
If the driver is compiled in the debug mode, the RVA for the Import Descriptor seems to be wrong. But the issue is resolved with compiling in the release rather than in the debug mode.
Thanks to all for the help.
1
This is unfortunately not going to be an answer, because you don't give enough information. If I end up writing an answer, it will be a different one. So long I'll make this non-answer a community wiki, attempting to give clues, ask for details and point to resources.
Correct me if I'm wrong but since kernel drivers share the same
address space I can just ...
1
as you mentioned in comments, you need to build class hierarchy or find vtables. Following are some projects that I know will help you in achieving what you would like.
classinformer - https://sourceforge.net/projects/classinformer/
Classy - https://github.com/RicBent/Classy
Hexpytools - https://github.com/igogo-x86/HexRaysPyTools
Also look @ this ...
1
Here is the solution:
The constructor can be called like this:
gladius::GameStruct* thisptr = (gladius::GameStruct*)malloc(sizeof(gladius::GameStruct));
gladius::get().gameConstructor(thisptr);
where sizeof(GameStruct) must match the size of the original constructor. In my case the Game structure should be re-written to have something like:
struct ...
1
This is been resolved here: Link
So, the solution is to introduce the class structure functionally the same as the original one and then use the original constructor function to populate it.
If the objects of the other classes, i.e. GUI object as a 5th element of the above structure needs to be initialised, then GUI object has to have a proper class ...
1
OK. Found the issue after checking the screenshots again. It seems that I simply missed the correct beginning of the function while examining Ghidra output.
Verifying everything once again as @blabb has suggested has shown that I've missed the correct address for the beginning of the function.
Here are screenshots for how to it was evaluated:
Address in ...
1
Fixed with using EasyHook instead of Detours. I.e. replaced this piece of code:
writeProtectedMemory(hook.first, hook.second);
auto result = DetourAttach(hook.first, hook.second);
with this:
HOOK_TRACE_INFO hHook = { NULL }; // keep track of our hook
NTSTATUS result = LhInstallHook(
hook.first,
hook.second,
NULL,
&hHook);
ULONG ...
1
You probably didn't catch that CStr is a variable in another class. This should be how it looks like from the data I can see.
class CStr {
int placeholder[2]; // unknown 0x8 bytes
char* somestring;
}
class some1 {
int placeholder; // unknown 0x4 bytes
CStr* cstr;
}
char* ptr = &(some1->cstr->somestring) would result in the pseudocode ...
1
The pattern you describe sounds like the standard pattern for returning objects by value. So you are looking for
class A {
B callee()
{
return B();
}
void caller()
{
B b = callee();
}
}
1
I presume the binary is fully optimized and stripped of debug info
My answer pertains to a windows binary (ex getinst.exe) but the generic concept applies to elf (ex foo.so )
some base presumptions about cocos2d from google are
appears to be 32 bit only
FileUtils appears to be a singleton implementation judging by the use of getInstance() and google
...
1
By finding the constructor for the structure type that you're looking at, making note of the VTable address, and adding the indicated offsets to obtain the concrete function pointers for the calls in question.
Only top voted, non community-wiki answers of a minimum length are eligible