Hot answers tagged

6 votes
Accepted

What is "nullsub_XXX" in vtable in IDA

Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well nullsub_X IDA ...
user avatar
  • 11.4k
4 votes
Accepted

How to hook to a system function

Two possibilities: Patch the call instruction to point to a destination of your choosing, such as a "code cave" between the end of the .text section and the subsequent section. Write your ...
user avatar
  • 7,879
3 votes

How to find specific function in IDA pro

Not a stupid question at all. Even the most seasoned reverse engineers run into issues with this task under sub optimal conditions. Like many challenges in this dark art, the solution, or strategies ...
user avatar
  • 31
3 votes
Accepted

Removing empty blocks ida api

That function was renamed from bool remove_empty_blocks(void) to bool remove_empty_and_unreachable_blocks(void) as of Hex-Rays 7.6. Just change the name of the function you're trying to call.
user avatar
  • 7,879
3 votes

Is it possible/feasible to decompile a program written in C++ to C?

If you're asking whether it's possible for an automated decompiler to produce C code as output for a given C++ input binary (rather than producing C++ code as output), the answer is that most ...
user avatar
  • 7,879
3 votes

How to restore struct fields

IDA knew that there was a struct named ComputeService::RPC due to a mangled name containing a reference to it -- for example, a mangled name for the function shown in your question. However, IDA did ...
user avatar
  • 7,879
3 votes
Accepted

Hex-rays decompiler incorrect logic

I was able to work this one out. The decompiler was not detecting the correct call parameter counts for the >> and << operators of cin and cout. For example: int __thiscall ...
user avatar
  • 151
3 votes
Accepted

How to find specific function in IDA pro

As it happens, I recently reverse engineered (and published an analysis of) a program that uses Curl, and I had the IDB open in the background. I decided to see if I could find the function in ...
user avatar
  • 7,879
2 votes

How to prevent File Modification in C++

You cannot prevent patching. There are ways to make reverse engineering harder, but the checksum approach is not the best way. There are way more advanced methods, that cannot be compared to a custom-...
user avatar
  • 21
2 votes

IAT Hook via Kernel Driver

The problem seems to be in the source address calculation: &ImportDescriptor.Name + (uintptr_t)ModuleBase This adds the address of a local variable (which is on the stack) to the image base, so ...
user avatar
  • 34.9k
2 votes

How do I reverse engineer structs that are put as parameters in a function

The function's name isn't struct dynamic_array. The function's name is Mesh::CalculateBoneBindPoseBounds. The function accepts an argument of type struct dynamic_array<...>. There's no function ...
user avatar
  • 11.4k
2 votes

How to restore struct fields

Is there a way to check what are the fields inside this struct? The old fashion way. Follow that pointer around through the assembly and see what offsets are used and how. If you can find where it's ...
user avatar
2 votes
Accepted

Understanding the meaning of EBP + 0xffff98b4

that is a negative number C:\>python -c "print(hex(0xffff98b4-2**32))" -0x674c or in other words C:\>python -c "print(hex(2**32 - 0x674c))" 0xffff98b4
user avatar
  • 15k
2 votes
Accepted

Strange DWORD/QWORD C++ Strings in decompilation

This is a standard method for the C and C++ compilers to build static strings directly on the stack. This method will be used by the compiler when compiling this code: #include <cstdio> int ...
user avatar
  • 136
1 vote

C++, Windows UI Automation and DaVinci Resolve

Qt does UI rendering on its own instead of relying on standard Win32 APIs, so accessibility APIs rarely work with Qt apps unless they implemented necessary interfaces. You may have better luck hooking ...
user avatar
  • 34.9k
1 vote
Accepted

Can a MSVC class have a deletion destructor without a vftable?

Apparently I was confused over the articles wording due to initially seeing deletion destructors as virtual destructors. I analyzed a small scratchpad program and realized the following: Deletion ...
user avatar
  • 993
1 vote
Accepted

Constructors testing for strange in-stack value

At a guess, the class participates in a virtual inheritance tree. When constructing a class with virtual bases, the constructor needs to know whether its virtual bases have been already constructed or ...
user avatar
  • 34.9k
1 vote

How could I find a call of a function thats only referenced inside a vftable?

From that screenshot you can see the base of the vtable is referenced - likely when the object is constructed. You'll need to keep an eye on where the object gets stored and follow it through the code
user avatar
1 vote
Accepted

One class with different sizes

It looks like CRefCountable is either a base class or the first member of the bigger class/structure being initialized. By itself, it is indeed only 8 bytes (vtable pointer and a data member, most ...
user avatar
  • 34.9k
1 vote

IntelPin, Ins_Insertcall?

that's because you are printing disassembly in instrumentation routine and "+++++" in analysis routine. PIN has theoretically been divided into two routines: instrumentation - where you ...
user avatar
  • 1,447
1 vote

How is it possible to generate C++ class header from a .dll or ELF file?

If you expect something like full class definitions with field and method names, it’s simply not possible: all such information is not necessary for program execution and is discarded by the compiler. ...
user avatar
  • 34.9k
1 vote
Accepted

IDA interpretation of switch-case statement

It's a compiler optimization used to implement switch statements that have many cases leading to one location. Note that the weird output is not Hex-Rays' doing, but rather, a more-or-less direct ...
user avatar
  • 7,879
1 vote
Accepted

IAT Hook via Kernel Driver

So, it turns out that if you're testing an IAT hook on a driver, the driver must be compiled in the release mode rather than in the debug one. If the driver is compiled in the debug mode, the RVA for ...
user avatar
  • 49
1 vote

IAT Hook via Kernel Driver

This is unfortunately not going to be an answer, because you don't give enough information. If I end up writing an answer, it will be a different one. So long I'll make this non-answer a community ...
1 vote

Analyze Arm Linux CPP binary in Ida Pro

as you mentioned in comments, you need to build class hierarchy or find vtables. Following are some projects that I know will help you in achieving what you would like. classinformer - https://...
user avatar
  • 1,447
1 vote
Accepted

How to declare a constructor in reversed class?

Here is the solution: The constructor can be called like this: gladius::GameStruct* thisptr = (gladius::GameStruct*)malloc(sizeof(gladius::GameStruct)); gladius::get().gameConstructor(thisptr);...
user avatar
  • 146
1 vote

How to identify method order in disassembled C++ object

I presume the binary is fully optimized and stripped of debug info My answer pertains to a windows binary (ex getinst.exe) but the generic concept applies to elf (ex foo.so ) some base presumptions ...
user avatar
  • 15k
1 vote
Accepted

Using struct objects and constructors in hooked function

This is been resolved here: Link So, the solution is to introduce the class structure functionally the same as the original one and then use the original constructor function to populate it. If the ...
user avatar
  • 146
1 vote
Accepted

Inconsistency in function addresses of the hooked functions (address shift)

OK. Found the issue after checking the screenshots again. It seems that I simply missed the correct beginning of the function while examining Ghidra output. Verifying everything once again as @blabb ...
user avatar
  • 146
1 vote
Accepted

DetourAttach breaks with Illegal Instruction 0xC000001D

Fixed with using EasyHook instead of Detours. I.e. replaced this piece of code: writeProtectedMemory(hook.first, hook.second); auto result = DetourAttach(hook.first, hook.second); with this: ...
user avatar
  • 146

Only top scored, non community-wiki answers of a minimum length are eligible