7
Generally you are doing almost all correct, there are however two simple mistakes.
First and probably most important is here
DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10;
The offset to ImageBaseAddress is not 10, it's 0x10 (16 in DEC). So you need to do it like this
DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 0x10;
Secondly, are ...
6
It takes the file name, but IDA doesn't recognise it.
In this example, IDA interpreted 4-byte string NUL\x00 (4E 55 4C 00) as an offset (address 0x004C554E) in the code. You may force it to interpret it as an ascii string simple by pressing a when the cursor is on the line 006A5D8C.
The reason that the byte order is reversed is that x86 architecture uses ...
6
It is rather C++ question, but nonetheless:
what you see is an assignment operator for the class QString. It enables you to write things like a = b, where a, b are of QString type.
The reason why it returns value is to enable you to write: a = b = c instead of a = c and b = c and you may see this pattern in case of other operators overloading (see question ...
6
I can only properly answer your first question:
I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find)
If your "firmware" is a filesystem that you can unpack, you can automatically load the libraries by:
Opening the regular Import File... dialog
Clicking Options inside ...
5
I can't really understand the speech from the Hlasový program at all, but perhaps it is suitable for your needs.
I don't have any specific knowledge of this particular software, but based on the time of release and the size, it's almost undoubtedly a formant-based system. The typical software (on the 8-bit computers of that vintage) used a text-to-phoneme ...
4
code does mean that something is interpreted as code to execute (most likely a function)
But more can be recovered from this snippet than just that something is executed:
Step 1: (**(code **)(*plVar5 + 0x10))
This is most likely a C++ vtable call.
plVar5 should be some variable containing a C++ object, or rather a pointer that should be interpreted as a ...
4
In binaries compiled with Visual C++, functions which use SEH (Structured exceptions handling), usually use var_4 ([ebp-4]) for the try level value (value specifying the current SEH scope block).
The value 0FFFFFFFFh (or -1) is used for the outermost, global function scope (i.e. before and after any __try blocks).
For more info check my OpenRCE article.
3
The Sequence of Bytes do not represent a string
please take note of the first 3 bytes 0x33,0xc0,0xc3
These are opcodes for xor eax,eax , retn basically return 0; in c / c++
0:000> eb . 33 c0 c3
0:000> u . l2
ntdll!LdrpDoDebuggerBreak+0x2c:
777a05a6 33c0 xor eax,eax
777a05a8 c3 ret
0:000>
this is probably a chunk ...
3
gdb is primarily a Source Level Debugger
to set a bp on an address instead of symbol use *
(gdb) break main
Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4.
(gdb) break *0x100401094
Note: breakpoint 1 also set at pc 0x100401094.
Breakpoint 2 at 0x100401094: file mingtest.cpp, line 4.
(gdb)
you can disassemble using address, length at any arbitrary ...
3
There is no instruction for pushing xmm registers, but you can do as follow:
__asm
{
sub esp, 16
movdqu [esp], xmm0
sub esp, 16
movdqu [esp], xmm1
pushad
}
MyExternalFunction();
__asm
{
popad
movdqu xmm1, [esp]
add esp, 16
movdqu xmm0, [esp]
add esp, 16
jmp AddressOfHookFunction
}
3
IIRC the typeid operator returns a pointer to a type info instance.
Overall the code looks like a lambda expression implementation; the “constructor” captures the context so that the “handler” (lambda body) can access the variables it needs from the outer scope.
2
I found the following documentation on archive.org, as part of Sun WorkShop™ for Solaris 2.x
mangling.ps
2
just modified your source a bit to print Rip prior and post in handler
added another exception and eliminated a warning (empty handler block)
and tested with +1,+2,+3 +4 +5 on the handler Hardware breaks doesn't get hit
I haven't checked by single stepping inside RtlpExecuteHandlerForxxx calls
here is a modified src
#include <windows.h>
#...
2
As @blabb says undname is correct so it's your other tool that is 'incorrect'.
However, it's worth looking at this in more detail as it's probably not as incorrect as you think.
To understand this though you have to delve a little into ABIs and think how a C++ function call works in practice.
Firstly, a C++ member function is in some sense like a C ...
2
Since I don't know any tool to solve your problem easily, I will tell you how it can be done "by hand".
First of all, you have to be familiar with PE format. If you are not, you may check aldeid and MSDN to understand the steps I will describe. Adding an export to dll is just extending Export Directory and possibly changing some other fields. So, ...
2
DirectX interfaces like IDirect3D9/IDirect3DDevice9 are COM interfaces and not C++ classes.
COM (OLE2) predates the wide use of C++ and uses a C-compatible calling convention, __stdcall, instead of the C++specific __thiscall. The use of ecx is a red herring; here it's used to load the function pointer (IDirect3D9::CreateDevice) and jump to it, not as the ...
2
as i commented i used windbg to dump those structures
sample code used for walk through
#include <iostream> //01
#include <list> //02
#include <vector> //03
#include <map> ...
2
In general, the compilation process removes most of the information not necessary for actual execution. This usually includes:
comments
local and global variable names
local (to the program) function names
any code deemed dead (not being executed in any situation)
code exhibiting undefined behavior
The names you are observing are Windows API names; because ...
2
The x86/x64 instruction set is variable length and there are no obvious instruction boundaries. You can make use of a length disassembler to figure out how long each instruction is. There are a bunch of them available, here’s a few I found by a quick search:
https://github.com/greenbender/lend
https://github.com/Nomade040/length-disassembler
https://github....
2
an indirect call , use of ecx as the this pointer etc indicates it is a virtual function call
lets take the example you quoted in your query modify it a little and see the disassembly
contents of directory pre compilation
D:\virt>dir /b
virt.cpp
source from example duly modified a bit
D:\virt>type virt.cpp
01 #include <iostream>
02 class Animal {...
1
This is an interesting problem where some issues have to be solved.
For the first part of your question: How to run an exe from memory, you might want to consult the following link:
https://stackoverflow.com/questions/305203/createprocess-from-memory-buffer
In the following, I will try to show you how to tackle your second question, how to call a class ...
1
you created those structures or you pulled it from somewhere ?
basically these are template classes and not structures
where did you get the size of 0x1c for std::string
it is 0x18
0x10 for buffer or Pointer (static small string or malloced() bigstring )
0x4 for Actualsize or_Mysize
0x4 for Reservedsize or _Myres
like
typedef struct _FOO {
union _Bx {
char ...
1
If the ASLR isn't enabled for the module, and it's loaded at the address of 0x400000 this is as simply as
DWORD address = 0x427000;
ReadProcessMemory(handle, (void*)address, &value, sizeof(value), NULL);
However if the ASLR is enabled (or the process just isn't mapped to memory starting at 0x400000) you need to get base address of the module. I assume ...
1
the instruction lea loads the Effective Address of its operand
so after executing lea rcx, qword ptr ds:[xxxxxxx]
rcx will hold the address xxxxxxx
so if you are sure you need rcx to be 0 in that instruction simply wipe the address from that specific operand
that is make 48:8d05 xyzabcd as 48:8d0425 00000000
or assemble lea rax,qword ptr ds:[0]
keep in mind ...
1
The first one is much better in my opinion:
It doesn't use deprecated function, that is probably kept only in the Detours library for backward compatibility
It uses pattern scanning, this is much better then embedding raw address, because lets say you are going to inject the .dll to a game, even if it's old singleplayer game it may have a lot of revisions, ...
1
First, you need to include the std libs you need
#include <xtree>
#include <set>
#include <map>
#include <functional>
Second you need to remove "struct" before all the variable declarations that aren't structs
and third you should delete everything from this header you don't need, it's 90% garbage
remove all instances of &...
1
It seems like you have an issue with dereferencing unallocated memory. I don't think that it's related to the heap in any way. It looks like the pointer address that is resolved by ptr [rcx+200h] is in fact points to 0xFFFFFFFFFFFFFFFF address, and when trying to access this memory, the application crashes, because this page is not allocated.
In order to ...
1
The default assignment operator for primitives returns a value, and the standard convention for operator overloading is to not deviate from the behavior of the operator you are overloading. This is why it's good practice to continue to return the assigned reference from the assignment overload operator.
Because of this behavior, there's a well-used idiom in ...
1
IDA’s C parser does not handle some C++ syntax like namespaces. There are two options:
Rename the local type or struct to have no “wrong” symbols, you can use it in type declaration then
Use “Convert to struct*” context menu command on the argument/variable. This bypasses the C parser and sets the type directly.
1
Both work with virtualization techniques, I recommend vm protect from experience and consider it slightly better in machine protection, buy the latest version, if you know how to try adding some of your own techniques, but I believe that only vm protect is enough to the protection of the executable, good luck.
Only top voted, non community-wiki answers of a minimum length are eligible
