Hot answers tagged

8

First it should be noted that there are so many architectures out there, each with its own instruction set. Here I assume you mean x86 (and you should indeed tag the proper architecture as 0xC0000022L said above). Most parts of the below answer would apply to other architectures as well, but they may use different mnemonics or lack some mentioned ...


6

The signature for mmap is void *mmap(void *addr, size_t length, int prot, int flags, int fd, off_t offset); 4294967295 is same as -1 when treated as a signed integer. The mmap calls actually looks like mmap( NULL, /*addr*/ 321, /*length*/ PROT_EXEC | PROT_READ | PROT_WRITE, /*...


5

I think I got it. GetWindowLongPtr(hWnd, -1) returns a pointer to a nested struct that is a part of the WND struct (that contains main information about a window.) There's really no official name for it, but judging by this function name in comctrl32: I'd define it as such: struct WF{ WF_STATE state; WF_STATE2 state2; DWORD ExStyles; //With ...


4

There are ways to make a Python program hard to reverse engineer. Its' possible but you need to fiddle with the Python source code (which is written in C) and compile a special build for your purpose. The way Python works is fully documented and open-source. For instance, consider the pyc file format. Much of the code which deals with reading/writing pyc's ...


4

The code isn't easy to read since one has to do that statically and it doesn't seem to respect a standard EABI. So, instead of trying to fully reverse engineer the code, I tried to search for the used constants instead and saw if the code matches with something: It turned out the algorithm is JCALG1. I made a quick and very ugly PoC from a code found on ...


3

Since you mentioned ELF in the tag. WinMain, DllMain, etc should not be a concern for you. They're name conventions for Windows. The main function is the first function executed for a C/C++ program. However, it doesn't mean this is the real first function / code executed. You will usually find some initialization code before this function is called. my ...


3

int main (void){ unsigned int uin = 0x1000; signed int sin = -0x1000; return (uin<<8)+(uin>>8)+(sin<<8)+(sin>>8); } compiled and linked with cl /Zi /W4 /Od /analyze /nologo salsaar.cpp /link /release disassembled :\>cdb -c "uf salsaar!main;q" salsaar.exe | grep -A 20 Reading 0:000> cdb: Reading ...


3

you mean the thread doesn't run when you have single stepped out of the CreateThread() call ?? if yes then the Windows Scheduler hasn't yet found time to Schedule your Threads Code you can confirm when the code is run by Setting breakpoint on the LP_THREAD_ROUTINE Argument passed to CreateThread() probably be in R8D in your screenshot i think ...


3

Unfortunately no, there is no such decompiler publicly available. All decompilers have to guess the missing information and just one wrong answer is enough to spoil the result. Second, re-compilability is often not the goal.


2

You can definitely edit the binary and implement a new function that handles caching and calls the original function as needed. Then just replace any call to your new cache-implementing function instead. You'll need to be careful when implementing the cache for a recursive function and decide if you wanna cache all intermediate results or only final results. ...


2

You just discovered why templates are accused of code bloat. That function is not added by IDA but instead by the compiler when it expanded the templated class std::vector<std::vector<Point*>> and generated all its member functions. Every std::vector with a different template parameter is considered a separate type. So std::vector<int>::...


2

#include <stdio.h> #include <windows.h> #include <intrin.h> void main (void) { __try { __debugbreak(); } __except( GetExceptionCode() == EXCEPTION_BREAKPOINT ? EXCEPTION_EXECUTE_HANDLER :EXCEPTION_CONTINUE_SEARCH ) { printf("executed out of debugger\n"); exit(1); } printf("...


2

This C code compiles to the equivalent of your assembly code: void f() { int b = 1; for (int a = 0; a<4; ++a) { b = b + a; } // disassembly finishes here but maybe there's something like below // return b; } The output on Compiler Explorer switches [ebp-8] and [ebp-4] and uses eax rather than ecx to increment the loop ...


2

Wrong Parameters I was able to solve my problem! The function execve has the following definition: int execve(const char *filename, char *const argv[], char *const envp[]);` ^ ^ ^ ^ eax ebx ecx edx So the second parameter argv is not just ...


2

It is possible to do what you want. There are some difficulties you may encounter though. I'll show you a short instruction how it can be done in several different cases. Have a look at ELF specification to know how every file in that format looks like, which sections it consists of and how they are located in the process image at the runtime. Even when ...


2

Program entry point != main You're seeing disassembly of a few of the functions automatically linked to the program by the compiler toolchain that are responsible for setting up the C Run-Time (CRT) environment. From Microsoft's CRT Initialization: By default, the linker includes the CRT library, which provides its own startup code. This startup code ...


2

I think this is a strcmp function which was compiled without optimization and is really inefficient. Here is why: The function only uses r0 and r1 which are first and the second parameter. Both parameters are pointer because they are dereferenced All memory access are byte long Read bytes are compared against '\0' Read bytes are compared using the ...


2

v2 = -1640531527; C:>python -c "print hex(0x100000000-1640531527)" 0x9e3779b9L google 0x9e3779b9L first hit TEA algorithm google python tea first hit pytea quoting from the site below from pytea import TEA key = os.urandom(16) print('key is', key) content = 'Hello, 你好' tea = TEA(key) e = tea.encrypt(content.encode()) print('encrypt hex:', e.hex()) ...


2

Just a quick note in case you would not be aware of this: $ cat tiny.c #include <unistd.h> void _start() { _exit(42); } on x86-64, here is what I get (you need a static libc: libc.a): $ gcc -static -ffreestanding -nostartfiles -s -o tiny tiny.c $ ./tiny || echo $? 42 Pay attention that: $ file tiny tiny: ELF 64-bit LSB executable, x86-64, ...


2

This question is a bit confusing. Both __fastcall and __thiscall share that they use ecx as the first storage point. So either you implicitly say the class pointer will be in ecx (__thiscall) or you say the function is not a member function but has one argument - which also gets passed in ecx when using __fastcall so the class pointer still ends up in the ...


1

you may either need to use the local variables or compile with optimizations disabled I assume you are using msvc on windows ?? shown below is a snippet that was compiled on x64 for x64 in win 10 where you can clearly see the local vars being initialized and used f:\git\usr\bin\ls -lg total 1 -rw-r--r-- 1 197121 61 Sep 25 15:24 local.cpp f:\git\usr\bin\...


1

I would like to extend the .text section and insert [code]. If there's a better method of inserting new functionality into an ELF I'm all ears. Techniques for adding arbitrary code to ELF files were pioneered by Linux virus writers beginning all the way back in the 1990s. In comparison with the methods they developed, as well as with more modern techniques,...


1

As @Chris Stratton already said, you don't give the right pointer value - you want to put \x10\x50\x75\x55\x55\x55\x00\x00 as that value. Your segfault comes from instruction: mov dword [rax], r13d where rax = 0x7838302555755010, which confirms that you need to put these 4 extra bytes (to overwrite 78383025 part). I do not know however how you can pass ...


1

execve specification says: Both argv and envp must be terminated by a NULL pointer. but from your question it seems, that you forgot about it; you want to call it like this: execve("/bin/cat", ["/bin/cat","/test/file", NULL], NULL) If it still doesn't work, here is the working code in C. You can then follow @user3629249's suggestion and use gcc -S ...


1

the v20 stuff is simply this->mem = new(); where this is a structure of some sort the dynamicdata constructor you posted is actually filling up a struct with 0 you need to change the int a1 to struct foo* a1 prior to that you need to define the struct in ida so since it is returning the struct pointer you need to change the return value also as struct ...


1

I think just replace mov eax, 0xfffffff4 and not eax


1

From Ghidra help: By default, the variables data type will be UndefinedN where N is the size (in bytes) of the stack reference. undefined stands for undefined1 and it's a type of size 1(byte) in Ghidra. If some variable is of this type, it basically means that decompiler didn't infer any "better" type for this variable (which could be bool or char for ...


1

This is not a question about reverse engineering, but you can use the DARPA Cyber Grand Challenge binaries that have been ported to Linux, Mac OS and Windows by the Trail of Bits team: The DARPA Challenge Binaries (CBs) are custom-made programs specifically designed to contain vulnerabilities that represent a wide variety of crashing software flaws. They ...


1

I think you mixed up segments and sections on ELF. Unlike PE where sections define how the application is mapped and page permissions, ELF loaders only use segments PT_LOAD to do that. Segments don't have name, so there's nothing like .rodata segment, only .rodata section. You can verify that be setting 0x0 to the field ElfN_Ehdr::e_shoff, it'll still work. ...


1

A buffer overflow happens when a program tries to write too much data into a buffer, or other data structure. The extra data "overflows" the buffer writes over the data structure immediately following the buffer in memory. memcpy allows you to specify the number of bytes to copy, but if that value varies, such as when it is dependent on user input, then ...


Only top voted, non community-wiki answers of a minimum length are eligible