2
This question is a bit confusing.
Both __fastcall and __thiscall share that they use ecx as the first storage point. So either you implicitly say the class pointer will be in ecx (__thiscall) or you say the function is not a member function but has one argument - which also gets passed in ecx when using __fastcall so the class pointer still ends up in the ...
1
You're correctly interpreting C++'s way of implementing class inheritance, however your assumption that the "subobject" is a member object of the class may be incorrect.
Through compiled code alone, It is impossible to completely distinguish member objects from additional inheritance in multiple inheritance classes as both appear the same. As a matter of ...
1
Could it be multiple inheritance? That could explain why the vptr of the supposed subobject is overwritten by ctor_2 without having to assume the compiler to inline anything. The derived class might actually have two base classes, the "base" and the "subobject". If this is the case, it kinda makes sense why the compiler would make ctor_3 to change the vptr ...
1
You have here multiple inheritance where both base classes have virtual destructors. The pattern you see in dtor_derived_so is a so-called "non-virtual thunk", which adjusts this before calling the whole class destructor. Normally you should also see 0xFFFFFFE0 (offset to base) in the second dword before the secondary vtables. I was able to produce code and ...
1
Procedure:
Get base address in x64dbg: Load the binary in x64dbg. Go to "Memory Map" tab.
Find the binary name in info column. Then copy the address with the right
click on it. For example, in the following screenshot, the x86_64 PE binary
name is Project1.exe and the base address is 0x00007FF6A4850000.
Rebase in IDA: Open the binary in IDA. Click on Edit >...
1
It's a matter where you want to break. The address 0x770B0D54 is in kernel code and it's probably before kernel starts executing user code. Useful if there's some magic happening before main is executed and you want to step through that.
On the other hand 0x00043b33 is int user code and it's probably the address of the main function so that is the real code ...
1
I would say this really depends on your definition of packing. Typically packing is limited to compression moreso than protection. In this case the binary is updated to maintain virtual memory while minimizing file size. The entry point will decompress everything so, despite the files differing, the virtual memory at the point of executing the original entry ...
1
Is there a difference between unpacked and dumped that I should know about while loading it in IDA to see the actual imports section?
You can dump anything not only packed binaries, but with packed ones it usually comes with stripped imports table just to make it hard(-er) to analyze.
After sample is unpacked it usually rebuild its import table so it can ...
Only top voted, non community-wiki answers of a minimum length are eligible
