6
votes
Accepted
Compile C# like C++?
There are a number of options:
C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime.
...
- 176
5
votes
Accepted
What are the first 16 bytes in .rodata section?
Trying to provide a more general answer that would hopefully complement this answer linked in the comments.
To those who are unsure, the .rodata section in an executable contains all read-only ...
- 11.7k
5
votes
How to find out if PE executable was compiled with gcc or VisualStudio?
While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
- 151
5
votes
Is there any decompiler, which can produce a compilable result?
Unfortunately no, there is no such decompiler publicly available. All decompilers have to guess the missing information and just one wrong answer is enough to spoil the result. Second, re-...
- 111
5
votes
Accepted
How to disable relro while compilation?
To enable full relro:
-Wl, -z,relro,-z,now
What does this do? - it provides -z,relro,-z,now flag to linker as an argument. This enables full relro (notice -z,now flag).
Partial relro is enabled by ...
- 1,767
4
votes
Extract non-extractable private key from OS X Keychain
I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here.
In my case, I did the following:
$ pip2 install hexdump pycrypto pyopenssl
$ git clone ...
- 141
4
votes
Accepted
How to get meaning of flags by integer
The flags are constants drawn from here:
https://github.com/torvalds/linux/blob/master/tools/include/uapi/asm-generic/fcntl.h
They can change but very rarely.
Applying this we can see that
0x241 =...
- 684
4
votes
Accepted
Why having a function with just one instruction
Very often functions like this will be listed within a vtable. This is where, within a language like C++, class objects can inherit functions and variables from other class objects.
If class A, the ...
- 422
4
votes
How to find out if PE executable was compiled with gcc or VisualStudio?
Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.
4
votes
Accepted
Name other than ".text" for the main code section
The section name can be anything, the OS loader only uses section flags to set up permissions when mapping the file into memory. For example, Delphi compiler uses CODE, and various packers use custom ...
- 36.2k
4
votes
Accepted
Why aren't compilers using registers for their intended purpose?
The "intended purpose" of a processor register is generally irrelevant to a compiler, unless something fundamental about the instruction set or architecture makes use of that aspect of the ...
- 9,088
3
votes
How to add code to compiled java class
There are several ways to achieve this:
Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
- 36.2k
3
votes
Accepted
Is all debug information of VS-compiled PE files contained in an external PDB file?
Old versions of link.exe supported the /debugtype argument that used these options:
/debugtype:coff
use COFF format
/debugtype:cv
use CodeView or Program Database format (depends on /pdb ...
- 851
3
votes
Accepted
Code generation patterns of compilers
I personally enjoy Reverse Engineering for Beginners (by Dennis Yurichev).
The book shows (among other things) lots of common code patterns being compiled to different architectures and using ...
- 1,041
2
votes
Accepted
What is all this code for?
I'll assume you have a general understanding of the x86 processor architecture, registers, and how the stack works. If you don't, there are a lot of introductions, tutorials, and books out there, ...
- 12.9k
2
votes
Accepted
C/C++ to Assembly language
I believe the best thing to do would be to learn about compilation in general and code generation in particular. The dragon book would be a good start. Then you can check Engineering a Compiler by ...
- 2,663
2
votes
Function dependencies in static libraries
You are actually asking multiple different questions here :
[Regarding static linking only a few functions of a library]
Are there any general reasons why this is not a good idea or impossible?...
- 565
2
votes
Accepted
Recognize certain components in the compiler produced assembly program
TL;DR: Hope for some magic numbers, or string constants you can xref, or you're in for a lot of manual work.
Searching for an arithmetic statement that doesn't include a very specific magic number, ...
- 12.9k
2
votes
Accepted
best c compiler on windows for reversing
This is a question which leads to a very subjective answer. I would (and have) install MinGW and then use gcc to compile your C code. You don't even need all the Visual Studio bloatware stuff for what ...
- 1,800
2
votes
Function Address Changes When Gets Referenced elsewhere
not sure what your question is
do you mean you get different address for the function every time you load it?
if yes then disable ASLR (address space layout randomization)
you can use the linker ...
- 16.2k
2
votes
Accepted
Shells CTF segfault - wrong address
I think your shellcode is missing the specifier for the bit-ness of the shellcode. You're compiling the shells in 32 bits, but for the nasm (I'm assuming you're using that) doesn't have anything. I'm ...
- 4,742
2
votes
Identify function in cpp static binary
As far as I know, there are 3 approaches that have been implemented to identify library functions:
IDA FLIRT essentially uses byte patterns to create function signatures
Ghidra's FunctionID feature ...
- 7,058
2
votes
How to add code to compiled java class
You can use JByteMod to edit your class bytecode.
You can also create new methods, delete methods, fields and change accesses.
Its pretty easy to use, just load the jar and select the class you want ...
- 141
2
votes
What are these functions for?
you should potentially provide what tool was used to disassemble the code in query (ida , dumpbin , others etc )
also you should give the compiler unit (gcc, clang , vc etc )
is that an object file ...
- 16.2k
2
votes
Creating the SkiFree 2 dream... An introduction
this is not about reverse engineering, you need to ask on stackoverflow about Windows/C programming
to the "Progess" you talking about
[x] Convert functions to C
[x] Convert data to C
[ ] ...
- 336
1
vote
Accepted
What does this instruction pairs mean?
The code uses this non-optimal form in order to match the original code. It is saving the value in the local "pid" variable so that a debugger can see it. Then it is fetching the value again in ...
- 4,701
1
vote
How to find out if PE executable was compiled with gcc or VisualStudio?
If you use WinDbg, an easy way to tell might be to simply do a search for 0x00400000 (or whatever the image base address is) through every code page.
I don't know why GCC does this but apparently, it ...
1
vote
How to find out if PE executable was compiled with gcc or VisualStudio?
The best heuristic would be code. I would create a hello world test file and compile it with the compilers I was interested in identifying.
Load them in the free version of IDA (or Pro if you've got ...
- 323
1
vote
Accepted
Can a Data Type Span Multiple Virtual Pages? (Windows)
I don't see why not.
For instance, if I'm mapping a binary file into memory, I may configure its structure as such:
//Visual Studio code
#pragma pack(push,1)
struct STRUCT1{
char dummy[0x1000 - ...
- 1,517
1
vote
Can a Data Type Span Multiple Virtual Pages? (Windows)
While it can happen as a result of hand-coded code, it is unlikely in practice to occur as a result of compiled code. Compilers generally align data appropriately such that a 4-bytes value will begin ...
- 4,701
Only top scored, non community-wiki answers of a minimum length are eligible