11
You must have been looking at the wrong representation.
Opening the file with a plain graphics viewer shows that it indeed contains "maps", in a 2-byte-per-block format and with a fixed width of 128 bytes/64 blocks:
The first 514 bytes seem to contain some other kind of data but after that every two bytes form one single map block. You'll have to compare ...
9
Visual Studio is inlining the function. You will need to tell VS to not do that:
__declspec(noinline) void someFunction()
{
printf("im scared world, i dont understand.\n");
}
7
Generally you are doing almost all correct, there are however two simple mistakes.
First and probably most important is here
DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 10;
The offset to ImageBaseAddress is not 10, it's 0x10 (16 in DEC). So you need to do it like this
DWORD_PTR pebOffset = (DWORD_PTR)pbi.PebBaseAddress + 0x10;
Secondly, are ...
6
I can only properly answer your first question:
I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find)
If your "firmware" is a filesystem that you can unpack, you can automatically load the libraries by:
Opening the regular Import File... dialog
Clicking Options inside ...
6
It is rather C++ question, but nonetheless:
what you see is an assignment operator for the class QString. It enables you to write things like a = b, where a, b are of QString type.
The reason why it returns value is to enable you to write: a = b = c instead of a = c and b = c and you may see this pattern in case of other operators overloading (see question ...
6
It takes the file name, but IDA doesn't recognise it.
In this example, IDA interpreted 4-byte string NUL\x00 (4E 55 4C 00) as an offset (address 0x004C554E) in the code. You may force it to interpret it as an ascii string simple by pressing a when the cursor is on the line 006A5D8C.
The reason that the byte order is reversed is that x86 architecture uses ...
4
code does mean that something is interpreted as code to execute (most likely a function)
But more can be recovered from this snippet than just that something is executed:
Step 1: (**(code **)(*plVar5 + 0x10))
This is most likely a C++ vtable call.
plVar5 should be some variable containing a C++ object, or rather a pointer that should be interpreted as a ...
4
In binaries compiled with Visual C++, functions which use SEH (Structured exceptions handling), usually use var_4 ([ebp-4]) for the try level value (value specifying the current SEH scope block).
The value 0FFFFFFFFh (or -1) is used for the outermost, global function scope (i.e. before and after any __try blocks).
For more info check my OpenRCE article.
4
You're correctly interpreting C++'s way of implementing class inheritance, however your assumption that the "subobject" is a member object of the class may be incorrect.
Through compiled code alone, It is impossible to completely distinguish member objects from additional inheritance in multiple inheritance classes as both appear the same. As a matter of ...
3
Could it be multiple inheritance? That could explain why the vptr of the supposed subobject is overwritten by ctor_2 without having to assume the compiler to inline anything. The derived class might actually have two base classes, the "base" and the "subobject". If this is the case, it kinda makes sense why the compiler would make ctor_3 to change the vptr ...
3
The Sequence of Bytes do not represent a string
please take note of the first 3 bytes 0x33,0xc0,0xc3
These are opcodes for xor eax,eax , retn basically return 0; in c / c++
0:000> eb . 33 c0 c3
0:000> u . l2
ntdll!LdrpDoDebuggerBreak+0x2c:
777a05a6 33c0 xor eax,eax
777a05a8 c3 ret
0:000>
this is probably a chunk ...
3
gdb is primarily a Source Level Debugger
to set a bp on an address instead of symbol use *
(gdb) break main
Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4.
(gdb) break *0x100401094
Note: breakpoint 1 also set at pc 0x100401094.
Breakpoint 2 at 0x100401094: file mingtest.cpp, line 4.
(gdb)
you can disassemble using address, length at any arbitrary ...
2
I found the following documentation on archive.org, as part of Sun WorkShop™ for Solaris 2.x
mangling.ps
2
This question is a bit confusing.
Both __fastcall and __thiscall share that they use ecx as the first storage point. So either you implicitly say the class pointer will be in ecx (__thiscall) or you say the function is not a member function but has one argument - which also gets passed in ecx when using __fastcall so the class pointer still ends up in the ...
2
As @blabb says undname is correct so it's your other tool that is 'incorrect'.
However, it's worth looking at this in more detail as it's probably not as incorrect as you think.
To understand this though you have to delve a little into ABIs and think how a C++ function call works in practice.
Firstly, a C++ member function is in some sense like a C ...
2
just modified your source a bit to print Rip prior and post in handler
added another exception and eliminated a warning (empty handler block)
and tested with +1,+2,+3 +4 +5 on the handler Hardware breaks doesn't get hit
I haven't checked by single stepping inside RtlpExecuteHandlerForxxx calls
here is a modified src
#include <windows.h>
#...
2
Since I don't know any tool to solve your problem easily, I will tell you how it can be done "by hand".
First of all, you have to be familiar with PE format. If you are not, you may check aldeid and MSDN to understand the steps I will describe. Adding an export to dll is just extending Export Directory and possibly changing some other fields. So, ...
2
DirectX interfaces like IDirect3D9/IDirect3DDevice9 are COM interfaces and not C++ classes.
COM (OLE2) predates the wide use of C++ and uses a C-compatible calling convention, __stdcall, instead of the C++specific __thiscall. The use of ecx is a red herring; here it's used to load the function pointer (IDirect3D9::CreateDevice) and jump to it, not as the ...
2
as i commented i used windbg to dump those structures
sample code used for walk through
#include <iostream> //01
#include <list> //02
#include <vector> //03
#include <map> ...
1
The default assignment operator for primitives returns a value, and the standard convention for operator overloading is to not deviate from the behavior of the operator you are overloading. This is why it's good practice to continue to return the assigned reference from the assignment overload operator.
Because of this behavior, there's a well-used idiom in ...
1
IDA’s C parser does not handle some C++ syntax like namespaces. There are two options:
Rename the local type or struct to have no “wrong” symbols, you can use it in type declaration then
Use “Convert to struct*” context menu command on the argument/variable. This bypasses the C parser and sets the type directly.
1
Both work with virtualization techniques, I recommend vm protect from experience and consider it slightly better in machine protection, buy the latest version, if you know how to try adding some of your own techniques, but I believe that only vm protect is enough to the protection of the executable, good luck.
1
The question is not clear. Are you asking about
an approach to finding a single input that results in "Correct" being printed? or
an approach to deriving a method that will generate correct inputs for you (e.g. keygenning)?
If it is 1, then the answer is as simple as using a calculator.
If it is 2, then many options exist, such as using a constraint ...
1
Your code basically takes 9 chars, 8 from user input + 1 null terminator.
each one can be between 0-255.
You char array bytes are signed, so maximum value for each is 127 (hex: 7F)
You want the result of those byte values to end up equal to 895.
In order to achieve the result, you need to pass any combination of bytes that sum up to your value.
Example:
...
1
there are lot of external utilities that can demangle a decorated name
try looking for vc++filt /
or some online demangler like this
or you can probably code one using dbghelp api UndecorateSymbolName() in python with ctype / pywin32
also undname isn't erring your second guess must be right
I just prototyped a similar function and looked at its ...
1
Extracting functions of .obj file (compiled by myself with Visual Studio 19) --> extracts wrong data
from your paste above I presume
You Want to get this data from the object files ( *.obj ) and not from the compiled and linked executable
if yes then COFF (component object file format ) is pretty well documented
all you need to parse is COFF SYMBOL TABLE
you can use dumpbin /SYMBOLS to look for all functions
C:\Users\xx\source\repos\dumpfuncs>...
1
Your problem is that you change the expected flow of the program - By patching the JMP you completely change the flow - it's not a call so the original flow doesn't get back to the push rdi instruction, but after patching it does, so the behavior is not expected. Try to look for what happens in 7FFCAE2A0F13, and maybe to patch inside.
1
Actually it was so obvious - I just haven't read the C++ standard and was writing throw() specification thinking it would allow all exceptions - instead it turned out it was the exact opposite.
And yes this throw function specification is what is causing those zero TryBlockMap with more than one Unwind entries. Here is a VC++ 6.0 (and later) compilable ...
1
From https://github.com/Siguza/ios-resources/blob/master/bits/arm64.md
x8 pointer to where to write the return value if >128 bits, otherwise scratch register
So it seems x8 is used to pass an address at which the return value will land if it's too big, rather than the return value directly, hence indirect I suppose.
I couldn't find official ...
1
Keep in mind Your program as is when compiled with -O will become just
mov eax,0
return
every thing out there in your Source is Dead Code and Will be eliminated
since you are compiling this in debug mode without any optimizations the compiler provides you all those variables
i am not sure what you mean by nearer to ebp
in debugmode compiler as far ...
Only top voted, non community-wiki answers of a minimum length are eligible
