New answers tagged c++
0
First, you need to include the std libs you need
#include <xtree>
#include <set>
#include <map>
#include <functional>
Second you need to remove "struct" before all the variable declarations that aren't structs
and third you should delete everything from this header you don't need, it's 90% garbage
remove all instances of &...
6
It takes the file name, but IDA doesn't recognise it.
In this example, IDA interpreted 4-byte string NUL\x00 (4E 55 4C 00) as an offset (address 0x004C554E) in the code. You may force it to interpret it as an ascii string simple by pressing a when the cursor is on the line 006A5D8C.
The reason that the byte order is reversed is that x86 architecture uses ...
1
It seems like you have an issue with dereferencing unallocated memory. I don't think that it's related to the heap in any way. It looks like the pointer address that is resolved by ptr [rcx+200h] is in fact points to 0xFFFFFFFFFFFFFFFF address, and when trying to access this memory, the application crashes, because this page is not allocated.
In order to ...
0
The window procedure is usually set up per window class via the call to RegisterClassW or similar. While it can be changed later by SetWindowLongPtr, in practice this is done quite rarely (AFAIK) so most likely the standard class procedure will be used. So:
Check calls to RegisterClassW/RegisterClassA and extract lpfnWndProc from the class struct
Hook the ...
1
The default assignment operator for primitives returns a value, and the standard convention for operator overloading is to not deviate from the behavior of the operator you are overloading. This is why it's good practice to continue to return the assigned reference from the assignment overload operator.
Because of this behavior, there's a well-used idiom in ...
6
It is rather C++ question, but nonetheless:
what you see is an assignment operator for the class QString. It enables you to write things like a = b, where a, b are of QString type.
The reason why it returns value is to enable you to write: a = b = c instead of a = c and b = c and you may see this pattern in case of other operators overloading (see question ...
1
IDA’s C parser does not handle some C++ syntax like namespaces. There are two options:
Rename the local type or struct to have no “wrong” symbols, you can use it in type declaration then
Use “Convert to struct*” context menu command on the argument/variable. This bypasses the C parser and sets the type directly.
1
Both work with virtualization techniques, I recommend vm protect from experience and consider it slightly better in machine protection, buy the latest version, if you know how to try adding some of your own techniques, but I believe that only vm protect is enough to the protection of the executable, good luck.
Top 50 recent answers are included
