New answers tagged

0

that's because you are printing disassembly in instrumentation routine and "+++++" in analysis routine. PIN has theoretically been divided into two routines: instrumentation - where you define your instrumentation points - happens when instruction is jitted analysis - where you execute actual instrumentation code - happens when instruction is ...


1

If you expect something like full class definitions with field and method names, it’s simply not possible: all such information is not necessary for program execution and is discarded by the compiler. Sometimes runtime type information (RTTI) with class names may remain if the program uses classes with virtual functions and RTTI has not been disabled by the ...


1

It's a compiler optimization used to implement switch statements that have many cases leading to one location. Note that the weird output is not Hex-Rays' doing, but rather, a more-or-less direct translation of what's in the assembly language. You didn't show the assembly for your snippet, but here's similar disassembly from a database I have open: .text:...


0

The triple pointer is a red herring. The actual type of the this parameter is a pointer to the class instance (e.g. Class1). The first member of the class structure is the virtual function table (vtable or vftable), which in turn consists of pointers to functions (virtual methods of the class). Because sub_xx43780 calls the first method in the vtable, to ...


1

So, it turns out that if you're testing an IAT hook on a driver, the driver must be compiled in the release mode rather than in the debug one. If the driver is compiled in the debug mode, the RVA for the Import Descriptor seems to be wrong. But the issue is resolved with compiling in the release rather than in the debug mode. Thanks to all for the help.


1

This is unfortunately not going to be an answer, because you don't give enough information. If I end up writing an answer, it will be a different one. So long I'll make this non-answer a community wiki, attempting to give clues, ask for details and point to resources. Correct me if I'm wrong but since kernel drivers share the same address space I can just ...


2

The problem seems to be in the source address calculation: &ImportDescriptor.Name + (uintptr_t)ModuleBase This adds the address of a local variable (which is on the stack) to the image base, so the result is probably some non-existent address. You should add its value, which is an RVA, to the image base. I.e. something like this: memcpy(&LibraryName,...


0

as you mentioned in comments, you need to build class hierarchy or find vtables. Following are some projects that I know will help you in achieving what you would like. classinformer - https://sourceforge.net/projects/classinformer/ Classy - https://github.com/RicBent/Classy Hexpytools - https://github.com/igogo-x86/HexRaysPyTools Also look @ this ...


1

This is been resolved here: Link So, the solution is to introduce the class structure functionally the same as the original one and then use the original constructor function to populate it. If the objects of the other classes, i.e. GUI object as a 5th element of the above structure needs to be initialised, then GUI object has to have a proper class ...


1

Here is the solution: The constructor can be called like this: gladius::GameStruct* thisptr = (gladius::GameStruct*)malloc(sizeof(gladius::GameStruct)); gladius::get().gameConstructor(thisptr); where sizeof(GameStruct) must match the size of the original constructor. In my case the Game structure should be re-written to have something like: struct ...


3

I was able to work this one out. The decompiler was not detecting the correct call parameter counts for the >> and << operators of cin and cout. For example: int __thiscall std__basic_istream_char_std__char_traits_char____operator__(_DWORD, _DWORD, _DWORD) Is the detected signature of the >> operator. However, reviewing the C++ reference, ...


5

Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well nullsub_X IDA makes a minimal effort of providing meaningful, yet general, names for functions according to their implementation by adding a prefix or name for certain types ...


Top 50 recent answers are included