Hot answers tagged

7

Generally you are doing almost all correct, there are however two simple mistakes. First and probably most important is here DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10; The offset to ImageBaseAddress is not 10, it's 0x10 (16 in DEC). So you need to do it like this DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 0x10; Secondly, are ...


6

It takes the file name, but IDA doesn't recognise it. In this example, IDA interpreted 4-byte string NUL\x00 (4E 55 4C 00) as an offset (address 0x004C554E) in the code. You may force it to interpret it as an ascii string simple by pressing a when the cursor is on the line 006A5D8C. The reason that the byte order is reversed is that x86 architecture uses ...


6

It is rather C++ question, but nonetheless: what you see is an assignment operator for the class QString. It enables you to write things like a = b, where a, b are of QString type. The reason why it returns value is to enable you to write: a = b = c instead of a = c and b = c and you may see this pattern in case of other operators overloading (see question ...


6

I can only properly answer your first question: I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find) If your "firmware" is a filesystem that you can unpack, you can automatically load the libraries by: Opening the regular Import File... dialog Clicking Options inside ...


5

I can't really understand the speech from the Hlasový program at all, but perhaps it is suitable for your needs. I don't have any specific knowledge of this particular software, but based on the time of release and the size, it's almost undoubtedly a formant-based system. The typical software (on the 8-bit computers of that vintage) used a text-to-phoneme ...


4

code does mean that something is interpreted as code to execute (most likely a function) But more can be recovered from this snippet than just that something is executed: Step 1: (**(code **)(*plVar5 + 0x10)) This is most likely a C++ vtable call. plVar5 should be some variable containing a C++ object, or rather a pointer that should be interpreted as a ...


4

In binaries compiled with Visual C++, functions which use SEH (Structured exceptions handling), usually use var_4 ([ebp-4]) for the try level value (value specifying the current SEH scope block). The value 0FFFFFFFFh (or -1) is used for the outermost, global function scope (i.e. before and after any __try blocks). For more info check my OpenRCE article.


3

The Sequence of Bytes do not represent a string please take note of the first 3 bytes 0x33,0xc0,0xc3 These are opcodes for xor eax,eax , retn basically return 0; in c / c++ 0:000> eb . 33 c0 c3 0:000> u . l2 ntdll!LdrpDoDebuggerBreak+0x2c: 777a05a6 33c0 xor eax,eax 777a05a8 c3 ret 0:000> this is probably a chunk ...


3

gdb is primarily a Source Level Debugger to set a bp on an address instead of symbol use * (gdb) break main Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4. (gdb) break *0x100401094 Note: breakpoint 1 also set at pc 0x100401094. Breakpoint 2 at 0x100401094: file mingtest.cpp, line 4. (gdb) you can disassemble using address, length at any arbitrary ...


3

There is no instruction for pushing xmm registers, but you can do as follow: __asm { sub esp, 16 movdqu [esp], xmm0 sub esp, 16 movdqu [esp], xmm1 pushad } MyExternalFunction(); __asm { popad movdqu xmm1, [esp] add esp, 16 movdqu xmm0, [esp] add esp, 16 jmp AddressOfHookFunction }


3

IIRC the typeid operator returns a pointer to a type info instance. Overall the code looks like a lambda expression implementation; the “constructor” captures the context so that the “handler” (lambda body) can access the variables it needs from the outer scope.


2

I found the following documentation on archive.org, as part of Sun WorkShop™ for Solaris 2.x mangling.ps


2

just modified your source a bit to print Rip prior and post in handler added another exception and eliminated a warning (empty handler block) and tested with +1,+2,+3 +4 +5 on the handler Hardware breaks doesn't get hit I haven't checked by single stepping inside RtlpExecuteHandlerForxxx calls here is a modified src #include <windows.h> #...


2

As @blabb says undname is correct so it's your other tool that is 'incorrect'. However, it's worth looking at this in more detail as it's probably not as incorrect as you think. To understand this though you have to delve a little into ABIs and think how a C++ function call works in practice. Firstly, a C++ member function is in some sense like a C ...


2

Since I don't know any tool to solve your problem easily, I will tell you how it can be done "by hand". First of all, you have to be familiar with PE format. If you are not, you may check aldeid and MSDN to understand the steps I will describe. Adding an export to dll is just extending Export Directory and possibly changing some other fields. So, ...


2

DirectX interfaces like IDirect3D9/IDirect3DDevice9 are COM interfaces and not C++ classes. COM (OLE2) predates the wide use of C++ and uses a C-compatible calling convention, __stdcall, instead of the C++specific __thiscall. The use of ecx is a red herring; here it's used to load the function pointer (IDirect3D9::CreateDevice) and jump to it, not as the ...


2

as i commented i used windbg to dump those structures sample code used for walk through #include <iostream> //01 #include <list> //02 #include <vector> //03 #include <map> ...


2

In general, the compilation process removes most of the information not necessary for actual execution. This usually includes: comments local and global variable names local (to the program) function names any code deemed dead (not being executed in any situation) code exhibiting undefined behavior The names you are observing are Windows API names; because ...


2

The x86/x64 instruction set is variable length and there are no obvious instruction boundaries. You can make use of a length disassembler to figure out how long each instruction is. There are a bunch of them available, here’s a few I found by a quick search: https://github.com/greenbender/lend https://github.com/Nomade040/length-disassembler https://github....


2

an indirect call , use of ecx as the this pointer etc indicates it is a virtual function call lets take the example you quoted in your query modify it a little and see the disassembly contents of directory pre compilation D:\virt>dir /b virt.cpp source from example duly modified a bit D:\virt>type virt.cpp 01 #include <iostream> 02 class Animal {...


1

This is an interesting problem where some issues have to be solved. For the first part of your question: How to run an exe from memory, you might want to consult the following link: https://stackoverflow.com/questions/305203/createprocess-from-memory-buffer In the following, I will try to show you how to tackle your second question, how to call a class ...


1

you created those structures or you pulled it from somewhere ? basically these are template classes and not structures where did you get the size of 0x1c for std::string it is 0x18 0x10 for buffer or Pointer (static small string or malloced() bigstring ) 0x4 for Actualsize or_Mysize 0x4 for Reservedsize or _Myres like typedef struct _FOO { union _Bx { char ...


1

If the ASLR isn't enabled for the module, and it's loaded at the address of 0x400000 this is as simply as DWORD address = 0x427000; ReadProcessMemory(handle, (void*)address, &value, sizeof(value), NULL); However if the ASLR is enabled (or the process just isn't mapped to memory starting at 0x400000) you need to get base address of the module. I assume ...


1

the instruction lea loads the Effective Address of its operand so after executing lea rcx, qword ptr ds:[xxxxxxx] rcx will hold the address xxxxxxx so if you are sure you need rcx to be 0 in that instruction simply wipe the address from that specific operand that is make 48:8d05 xyzabcd as 48:8d0425 00000000 or assemble lea rax,qword ptr ds:[0] keep in mind ...


1

The first one is much better in my opinion: It doesn't use deprecated function, that is probably kept only in the Detours library for backward compatibility It uses pattern scanning, this is much better then embedding raw address, because lets say you are going to inject the .dll to a game, even if it's old singleplayer game it may have a lot of revisions, ...


1

First, you need to include the std libs you need #include <xtree> #include <set> #include <map> #include <functional> Second you need to remove "struct" before all the variable declarations that aren't structs and third you should delete everything from this header you don't need, it's 90% garbage remove all instances of &...


1

It seems like you have an issue with dereferencing unallocated memory. I don't think that it's related to the heap in any way. It looks like the pointer address that is resolved by ptr [rcx+200h] is in fact points to 0xFFFFFFFFFFFFFFFF address, and when trying to access this memory, the application crashes, because this page is not allocated. In order to ...


1

The default assignment operator for primitives returns a value, and the standard convention for operator overloading is to not deviate from the behavior of the operator you are overloading. This is why it's good practice to continue to return the assigned reference from the assignment overload operator. Because of this behavior, there's a well-used idiom in ...


1

IDA’s C parser does not handle some C++ syntax like namespaces. There are two options: Rename the local type or struct to have no “wrong” symbols, you can use it in type declaration then Use “Convert to struct*” context menu command on the argument/variable. This bypasses the C parser and sets the type directly.


1

Both work with virtualization techniques, I recommend vm protect from experience and consider it slightly better in machine protection, buy the latest version, if you know how to try adding some of your own techniques, but I believe that only vm protect is enough to the protection of the executable, good luck.


Only top voted, non community-wiki answers of a minimum length are eligible