New answers tagged c++
0
This code can be cleaned up to be a bit more readable
void __cdecl decrypt(char *dst,char *src)
{
byte j;
uint i;
i = 0;
while (j = (byte)i, (char)j < 8) {
dst[i] = ((dst[i] ^ src[i]) << (j & 7) | (byte)(dst[i] ^ src[i]) >> 8 - (j & 7)) - j;
i = (uint)(byte)(j + 1);
}
return;
}
But the shifting and or-ing still ...
0
Arrange your plugin like this:
# your imports
import idc
#...
# wait for auto-analysis to complete
def PLUGIN_ENTRY():
idaapi.auto_wait()
return yourthing()
###do your thing
###
def yourthing(): pass
check an example: https://github.com/nadineOzz/polichombr/blob/80805164e85c2d21ffadffdd9ed8e2e4ea36fa9c/skelenox.py
good read: https://hex-rays.com/...
1
You probably didn't catch that CStr is a variable in another class. This should be how it looks like from the data I can see.
class CStr {
int placeholder[2]; // unknown 0x8 bytes
char* somestring;
}
class some1 {
int placeholder; // unknown 0x4 bytes
CStr* cstr;
}
char* ptr = &(some1->cstr->somestring) would result in the pseudocode ...
1
The pattern you describe sounds like the standard pattern for returning objects by value. So you are looking for
class A {
B callee()
{
return B();
}
void caller()
{
B b = callee();
}
}
0
If you are using IDA Pro, there are plugins to reconstruct the RTTI (runtime type identification) of the classes you are interested in. Take a look at medigate. There are other similar plugins as well which you can find on the web.
0
You can use a packer. Packers such as VMProtect, have something called virtualization engine - where code is encrypted, never actually decrypted, because it runs through a virtual CPU. This is probably the toughest thing to crack in any client-sided protection possible.
There are a few other packers out that have this feature as well. If you really want top ...
0
Thought about this and it seems in this address ((this + 0x5e8) + 0x50) the values are like this:
this + 0x5e8 - is an address of the structure in the particular class
0x50 - is an address of the element within that structure, could occupy any position as we don't know by just looking at it of how many other elements are there and what sizes do they have.
...
0
You cannot prevent patching. There are ways to make reverse engineering harder but the checksum approach is not the best way. There are way more advanced methods, that canmot be compared to a custom made antitampering routine.
Even those advanced methods become eventual studied and cracked.
Either you have to rely on commercial protections (maybe hardeware ...
Top 50 recent answers are included