Hot answers tagged

8

The problem is: you are smashing the stack. Lets look at the function you want to patch: As you can see, it pushes four parameters to the stack and calls USER32!MessageBoxA. A quick look at its documentation shows us, it expects four parameters and utilizes the standard WINAPI calling convention (also known as __stdcall). One thing in its description is ...


6

It is rather C++ question, but nonetheless: what you see is an assignment operator for the class QString. It enables you to write things like a = b, where a, b are of QString type. The reason why it returns value is to enable you to write: a = b = c instead of a = c and b = c and you may see this pattern in case of other operators overloading (see question ...


3

Wow, I actually figured out enough of angr to do it. Consider this C program (an extremely simplified scale model of qt_metacall): #include <stdio.h> int foo(void) { return puts("foo"); } int bar(void) { return puts("bar"); } int baz(void) { return puts("baz"); } int frob(int n) { switch (n) { case 1: return foo(); ...


2

I recommend to use IDA for this task but you can try something other. There are dozens of disassemblers. Open your app in the disassebmler, locate something like that: Scroll up and find XRef with 'qt_metacast(char const*)' (in case the binary is not stripped): .rodata:00069B90 aMainwindow_0 db 'MainWindow',0 ; DATA XREF: MainWindow::qt_metacast(...


2

the function toString Returns a Qstring in rax doing db poi(@rax) should show you the string after you step over the function a small automated breakpoint setting a conditional breakpoint that sets another one shot breakpoint on return address and prints the content of rax and continues 0:006> bl (should be in one line ) 0 e Disable Clear ...


2

You need to build Qt 5.5.1 using MinGw 4.9.2. and guess all the build options that the developer used originally. Then use FLAIR for you IDA version to generate pat files from .a libraries. Then compile pat files into sig files. Put sig files to \IDA\sig and try to apply them.


1

The default assignment operator for primitives returns a value, and the standard convention for operator overloading is to not deviate from the behavior of the operator you are overloading. This is why it's good practice to continue to return the assigned reference from the assignment overload operator. Because of this behavior, there's a well-used idiom in ...


1

Qt resources are stored in a pseudo-filesystem in the program itself as binary blobs of data. I'm not aware of any ready-made project to extract them from a compiled binary but you can exploit the fact that they are usually stored using zlib compression and use something like offzip to extract all zlib-compressed streams in the binary.


1

Did you try printqs5static $rdi? Assuming that call goes to the function with the prototype QDebug & QDebug::operator<<(const QString & s), then it's rdi that should contain the QString, not RSI. Another option is to dump memory around rdi and rsi. I doubt the object is super complicated, so there should be a pointer to a normal C string ...


1

I would try another approach, without using Olly or IDA, get Cheat Engine, attach it to your software and give X clicks. Search that int value on C.E., and increment while searching too. Cheat Engine will "catch" the variable faster than searching through regular debuggers. Set the var to 0 and lock it. Yes, I know C.E. is not a reversing tool, but in this ...


1

Take a look at the file Properties->Details of "QtCore4.dll" it uses to see what Qt version it is. Go to Qt website download page and get the matching version. There are both full source and compiled distributions there. You will probably have to rebuild it to match your application's compile settings. For instance if you see the application is using "...


1

The naming conventions for JNI functions are given by the Dalvik VM, a library couldn't change them and expect them to work, i.e. be callable from the Java part of the application. But, the Java_package_function convention is only needed for functions that Java wants to call, it it not neccesary for a C/C++ function calling another one. If you compile ...


Only top voted, non community-wiki answers of a minimum length are eligible