6
votes
Accepted
What is "nullsub_XXX" in vtable in IDA
Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well
nullsub_X
IDA ...
- 11.4k
4
votes
Accepted
How to hook to a system function
Two possibilities:
Patch the call instruction to point to a destination of your choosing, such as a "code cave" between the end of the .text section and the subsequent section. Write your ...
- 7,879
3
votes
How to find specific function in IDA pro
Not a stupid question at all. Even the most seasoned reverse engineers run into issues with this task under sub optimal conditions. Like many challenges in this dark art, the solution, or strategies ...
- 31
3
votes
Accepted
Removing empty blocks ida api
That function was renamed from bool remove_empty_blocks(void) to bool remove_empty_and_unreachable_blocks(void) as of Hex-Rays 7.6. Just change the name of the function you're trying to call.
- 7,879
3
votes
Is it possible/feasible to decompile a program written in C++ to C?
If you're asking whether it's possible for an automated decompiler to produce C code as output for a given C++ input binary (rather than producing C++ code as output), the answer is that most ...
- 7,879
3
votes
How to restore struct fields
IDA knew that there was a struct named ComputeService::RPC due to a mangled name containing a reference to it -- for example, a mangled name for the function shown in your question. However, IDA did ...
- 7,879
3
votes
Accepted
Hex-rays decompiler incorrect logic
I was able to work this one out.
The decompiler was not detecting the correct call parameter counts for the >> and << operators of cin and cout.
For example:
int __thiscall ...
- 151
3
votes
Accepted
How to find specific function in IDA pro
As it happens, I recently reverse engineered (and published an analysis of) a program that uses Curl, and I had the IDB open in the background. I decided to see if I could find the function in ...
- 7,879
2
votes
How to prevent File Modification in C++
You cannot prevent patching. There are ways to make reverse engineering harder, but the checksum approach is not the best way. There are way more advanced methods, that cannot be compared to a custom-...
- 21
2
votes
IAT Hook via Kernel Driver
The problem seems to be in the source address calculation:
&ImportDescriptor.Name + (uintptr_t)ModuleBase
This adds the address of a local variable (which is on the stack) to the image base, so ...
- 34.9k
2
votes
How do I reverse engineer structs that are put as parameters in a function
The function's name isn't struct dynamic_array. The function's name is Mesh::CalculateBoneBindPoseBounds.
The function accepts an argument of type struct dynamic_array<...>.
There's no function ...
- 11.4k
2
votes
How to restore struct fields
Is there a way to check what are the fields inside this struct?
The old fashion way. Follow that pointer around through the assembly and see what offsets are used and how. If you can find where it's ...
- 176
2
votes
Accepted
Understanding the meaning of EBP + 0xffff98b4
that is a negative number
C:\>python -c "print(hex(0xffff98b4-2**32))"
-0x674c
or in other words
C:\>python -c "print(hex(2**32 - 0x674c))"
0xffff98b4
- 15k
2
votes
Accepted
Strange DWORD/QWORD C++ Strings in decompilation
This is a standard method for the C and C++ compilers to build static strings directly on the stack. This method will be used by the compiler when compiling this code:
#include <cstdio>
int ...
- 136
1
vote
C++, Windows UI Automation and DaVinci Resolve
Qt does UI rendering on its own instead of relying on standard Win32 APIs, so accessibility APIs rarely work with Qt apps unless they implemented necessary interfaces. You may have better luck hooking ...
- 34.9k
1
vote
Accepted
Can a MSVC class have a deletion destructor without a vftable?
Apparently I was confused over the articles wording due to initially seeing deletion destructors as virtual destructors. I analyzed a small scratchpad program and realized the following:
Deletion ...
- 993
1
vote
Accepted
Constructors testing for strange in-stack value
At a guess, the class participates in a virtual inheritance tree. When constructing a class with virtual bases, the constructor needs to know whether its virtual bases have been already constructed or ...
- 34.9k
1
vote
How could I find a call of a function thats only referenced inside a vftable?
From that screenshot you can see the base of the vtable is referenced - likely when the object is constructed. You'll need to keep an eye on where the object gets stored and follow it through the code
- 51
1
vote
Accepted
One class with different sizes
It looks like CRefCountable is either a base class or the first member of the bigger class/structure being initialized. By itself, it is indeed only 8 bytes (vtable pointer and a data member, most ...
- 34.9k
1
vote
IntelPin, Ins_Insertcall?
that's because you are printing disassembly in instrumentation routine and "+++++" in analysis routine.
PIN has theoretically been divided into two routines:
instrumentation - where you ...
- 1,447
1
vote
How is it possible to generate C++ class header from a .dll or ELF file?
If you expect something like full class definitions with field and method names, it’s simply not possible: all such information is not necessary for program execution and is discarded by the compiler. ...
- 34.9k
1
vote
Accepted
IDA interpretation of switch-case statement
It's a compiler optimization used to implement switch statements that have many cases leading to one location. Note that the weird output is not Hex-Rays' doing, but rather, a more-or-less direct ...
- 7,879
1
vote
Accepted
IAT Hook via Kernel Driver
So, it turns out that if you're testing an IAT hook on a driver, the driver must be compiled in the release mode rather than in the debug one.
If the driver is compiled in the debug mode, the RVA for ...
- 49
1
vote
IAT Hook via Kernel Driver
This is unfortunately not going to be an answer, because you don't give enough information. If I end up writing an answer, it will be a different one. So long I'll make this non-answer a community ...
1
vote
Analyze Arm Linux CPP binary in Ida Pro
as you mentioned in comments, you need to build class hierarchy or find vtables. Following are some projects that I know will help you in achieving what you would like.
classinformer - https://...
- 1,447
1
vote
Accepted
How to declare a constructor in reversed class?
Here is the solution:
The constructor can be called like this:
gladius::GameStruct* thisptr = (gladius::GameStruct*)malloc(sizeof(gladius::GameStruct));
gladius::get().gameConstructor(thisptr);...
- 146
1
vote
How to identify method order in disassembled C++ object
I presume the binary is fully optimized and stripped of debug info
My answer pertains to a windows binary (ex getinst.exe) but the generic concept applies to elf (ex foo.so )
some base presumptions ...
- 15k
1
vote
Accepted
Using struct objects and constructors in hooked function
This is been resolved here: Link
So, the solution is to introduce the class structure functionally the same as the original one and then use the original constructor function to populate it.
If the ...
- 146
1
vote
Accepted
Inconsistency in function addresses of the hooked functions (address shift)
OK. Found the issue after checking the screenshots again. It seems that I simply missed the correct beginning of the function while examining Ghidra output.
Verifying everything once again as @blabb ...
- 146
1
vote
Accepted
DetourAttach breaks with Illegal Instruction 0xC000001D
Fixed with using EasyHook instead of Detours. I.e. replaced this piece of code:
writeProtectedMemory(hook.first, hook.second);
auto result = DetourAttach(hook.first, hook.second);
with this:
...
- 146
Only top scored, non community-wiki answers of a minimum length are eligible