Skip to main content
6 votes
Accepted

Compile C# like C++?

There are a number of options: C# code can be compiled to native code (like C++ compilation) using Ngen.exe or .NET Native. Although the IL code and metadata might still be required by the runtime. ...
Hadi Brais's user avatar
6 votes
Accepted

How to disable relro while compilation?

To enable full relro: -Wl, -z,relro,-z,now What does this do? - it provides -z,relro,-z,now flag to linker as an argument. This enables full relro (notice -z,now flag). Partial relro is enabled by ...
R4444's user avatar
  • 1,807
5 votes
Accepted

What are the first 16 bytes in .rodata section?

Trying to provide a more general answer that would hopefully complement this answer linked in the comments. To those who are unsure, the .rodata section in an executable contains all read-only ...
NirIzr's user avatar
  • 11.8k
5 votes

Is there any decompiler, which can produce a compilable result?

Unfortunately no, there is no such decompiler publicly available. All decompilers have to guess the missing information and just one wrong answer is enough to spoil the result. Second, re-...
Ilfak Guilfanov's user avatar
5 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

While not a definitive way of determining if GCC OR MSVC (Visual Studio) was used, the presence of the Rich header does determine whether Microsoft's link.exe (MS VC Toolset's linker) was used. (Note: ...
SheepReaper's user avatar
4 votes
Accepted

Name other than ".text" for the main code section

The section name can be anything, the OS loader only uses section flags to set up permissions when mapping the file into memory. For example, Delphi compiler uses CODE, and various packers use custom ...
Igor Skochinsky's user avatar
  • 36.8k
4 votes

How to find out if PE executable was compiled with gcc or VisualStudio?

Additional to PE detection tools (like PEiD, Detect it easy ,Etc) there is some especial code patterns for GCC and MSVC for example GCC use MOVinst instead of PUSH inst for pushing a value on stack.
EIP Passenger's user avatar
4 votes
Accepted

How to get meaning of flags by integer

The flags are constants drawn from here: https://github.com/torvalds/linux/blob/master/tools/include/uapi/asm-generic/fcntl.h They can change but very rarely. Applying this we can see that 0x241 =...
Abigail's user avatar
  • 684
4 votes
Accepted

Why having a function with just one instruction

Very often functions like this will be listed within a vtable. This is where, within a language like C++, class objects can inherit functions and variables from other class objects. If class A, the ...
Twifty's user avatar
  • 422
4 votes

Extract non-extractable private key from OS X Keychain

I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here. In my case, I did the following: $ pip2 install hexdump pycrypto pyopenssl $ git clone ...
standy's user avatar
  • 141
4 votes
Accepted

Why aren't compilers using registers for their intended purpose?

The "intended purpose" of a processor register is generally irrelevant to a compiler, unless something fundamental about the instruction set or architecture makes use of that aspect of the ...
Rolf Rolles's user avatar
  • 9,198
3 votes

How to add code to compiled java class

There are several ways to achieve this: Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

Is all debug information of VS-compiled PE files contained in an external PDB file?

Old versions of link.exe supported the /debugtype argument that used these options: /debugtype:coff use COFF format /debugtype:cv use CodeView or Program Database format (depends on /pdb ...
josh poley's user avatar
2 votes
Accepted

C/C++ to Assembly language

I believe the best thing to do would be to learn about compilation in general and code generation in particular. The dragon book would be a good start. Then you can check Engineering a Compiler by ...
yaspr's user avatar
  • 2,673
2 votes

Function dependencies in static libraries

You are actually asking multiple different questions here : [Regarding static linking only a few functions of a library] Are there any general reasons why this is not a good idea or impossible?...
user2823000's user avatar
2 votes
Accepted

Recognize certain components in the compiler produced assembly program

TL;DR: Hope for some magic numbers, or string constants you can xref, or you're in for a lot of manual work. Searching for an arithmetic statement that doesn't include a very specific magic number, ...
Guntram Blohm's user avatar
2 votes
Accepted

best c compiler on windows for reversing

This is a question which leads to a very subjective answer. I would (and have) install MinGW and then use gcc to compile your C code. You don't even need all the Visual Studio bloatware stuff for what ...
the_endian's user avatar
  • 1,870
2 votes
Accepted

Shells CTF segfault - wrong address

I think your shellcode is missing the specifier for the bit-ness of the shellcode. You're compiling the shells in 32 bits, but for the nasm (I'm assuming you're using that) doesn't have anything. I'm ...
Paweł Łukasik's user avatar
2 votes

Function Address Changes When Gets Referenced elsewhere

not sure what your question is do you mean you get different address for the function every time you load it? if yes then disable ASLR (address space layout randomization) you can use the linker ...
blabb's user avatar
  • 16.4k
2 votes

How to add code to compiled java class

You can use JByteMod to edit your class bytecode. You can also create new methods, delete methods, fields and change accesses. Its pretty easy to use, just load the jar and select the class you want ...
Princekin's user avatar
  • 141
2 votes

Identify function in cpp static binary

As far as I know, there are 3 approaches that have been implemented to identify library functions: IDA FLIRT essentially uses byte patterns to create function signatures Ghidra's FunctionID feature ...
julian's user avatar
  • 7,178
2 votes

What are these functions for?

you should potentially provide what tool was used to disassemble the code in query (ida , dumpbin , others etc ) also you should give the compiler unit (gcc, clang , vc etc ) is that an object file ...
blabb's user avatar
  • 16.4k
2 votes

Creating the SkiFree 2 dream... An introduction

this is not about reverse engineering, you need to ask on stackoverflow about Windows/C programming to the "Progess" you talking about [x] Convert functions to C [x] Convert data to C [ ] ...
llm's user avatar
  • 336
1 vote
Accepted

Decompilation of CIL code into some high level code - do I need to introduce new variables during data flow analysis?

The problem, as I think you realise, is that you are logically moving the calculation of an expression past the point whereby one of its input values gets changed. Given your current implementation, I'...
Ian Cook's user avatar
  • 2,558
1 vote

How to find out if PE executable was compiled with gcc or VisualStudio?

If you use WinDbg, an easy way to tell might be to simply do a search for 0x00400000 (or whatever the image base address is) through every code page. I don't know why GCC does this but apparently, it ...
Jerry Hundric's user avatar
1 vote

How to find out if PE executable was compiled with gcc or VisualStudio?

The best heuristic would be code. I would create a hello world test file and compile it with the compilers I was interested in identifying. Load them in the free version of IDA (or Pro if you've got ...
ben_re's user avatar
  • 323
1 vote
Accepted

What does this instruction pairs mean?

The code uses this non-optimal form in order to match the original code. It is saving the value in the local "pid" variable so that a debugger can see it. Then it is fetching the value again in ...
peter ferrie's user avatar
  • 4,709
1 vote

best c compiler on windows for reversing

Kris Kaspersky's (RIP) book called Hacker Disassembly Uncovered (freely available in chm format, just google for it) has a whole chapter just on that topic - he shows different code snippets (starting ...
NirIzr's user avatar
  • 11.8k
1 vote
Accepted

Can a Data Type Span Multiple Virtual Pages? (Windows)

I don't see why not. For instance, if I'm mapping a binary file into memory, I may configure its structure as such: //Visual Studio code #pragma pack(push,1) struct STRUCT1{ char dummy[0x1000 - ...
c00000fd's user avatar
  • 1,711
1 vote

Can a Data Type Span Multiple Virtual Pages? (Windows)

While it can happen as a result of hand-coded code, it is unlikely in practice to occur as a result of compiled code. Compilers generally align data appropriately such that a 4-bytes value will begin ...
peter ferrie's user avatar
  • 4,709

Only top scored, non community-wiki answers of a minimum length are eligible