 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
ThereIsNoSpoon
How do I cheat?
![]() Reputation: 0
Joined: 27 Oct 2015
Posts: 8
Location: DWORD PTR
|
 Posted: Sun Nov 01, 2015 3:02 pm Post subject: [C++] Why is my VC++ EmptyProject generating so much crap? |
 |
|
Hey all,
I want to flex my reverse engineering skills, so I had a thought - writing your own small apps seem to be a perfect choice to get the basic knowledge of how the struff works. But not necessarily.
Every single application I try to wrote and analyze by IDA is full of crap and especially, its missing these esential parts of code I would like to analyze.
Lets assume I have an application, looking like this:
| Code: | unsigned int a();
unsigned char b();
unsigned int c(unsigned int val);
unsigned char d(unsigned char val);
int main(int argc, char** argv) {
a();
b();
c(0xDEADBEEF);
d(0xFF);
return 0;
}
unsigned int a() {
return 0xDEADBEEF;
}
unsigned char b() {
return 0xff;
}
unsigned int c(unsigned int val) {
return val;
}
unsigned char d(unsigned char val) {
return val;
} |
Even though this is an empty project*, instead of having nice and clean view of my app, I am always getting all sorts of crap, like the example below.
| Code: | __setargv .text 00401000 00000003 R . . . . T .
__security_check_cookie(x) .text 00401003 0000000F R . . . . T .
pre_c_init .text 00401012 000000B9 R . . . . T .
pre_cpp_init .text 004010CB 0000004B R . . . . . .
__tmainCRTStartup .text 00401116 00000165 R . . . B T .
_mainCRTStartup .text 0040127B 0000000A R . L . . T .
___raise_securityfailure .text 00401285 0000003D R . . . B T .
___report_gsfailure .text 004012C2 000000FB R . . . B . .
__CxxUnhandledExceptionFilter(_EXCEPTION_POINTERS *) .text 004013BD 00000040 R . . . B T .
___CxxSetUnhandledExceptionFilter .text 004013FE 0000000E R . . . . T .
__XcptFilter .text 0040140C 00000006 R . . . . . .
__amsg_exit .text 00401412 00000006 R . . . . . .
__FindPESection .text 00401420 00000043 R . . . B T .
__IsNonwritableInCurrentImage .text 00401470 000000BA R . . . B T .
__ValidateImageBase .text 00401530 00000031 R . . . B T .
___security_init_cookie .text 00401561 0000009C R . . . B . .
___atonexitinit .text 004015FD 0000003C R . . . . T .
__onexit .text 00401639 000000A9 R . . . B T .
_atexit .text 004016E2 00000015 R . . . B T .
__RTC_Initialize .text 004016F7 00000020 R . . . . . .
__RTC_Terminate .text 00401717 00000020 R . . . . T .
__setdefaultprecision .text 00401737 00000027 R . . . . . .
__initterm_e .text 0040175E 00000006 R . . . . . .
__initterm .text 00401764 00000006 R . . . . . .
__SEH_prolog4 .text 00401770 00000045 R . L . . . .
__SEH_epilog4 .text 004017B5 00000014 R . L . . . .
__except_handler4 .text 004017C9 00000023 R . . . B T .
__crt_debugger_hook .text 004017EC 00000006 R . . . . . .
___crtUnhandledException .text 004017F2 00000006 R . . . . . .
___crtTerminateProcess .text 004017F8 00000006 R . . . . . .
terminate(void) .text 004017FE 00000006 . . . . . T .
___crtSetUnhandledExceptionFilter .text 00401804 00000006 R . . . . . .
__lock .text 0040180A 00000006 R . . . . . .
__unlock .text 00401810 00000006 R . . . . . .
___dllonexit .text 00401816 00000006 R . . . . . .
__invoke_watson .text 0040181C 00000006 R . . . . . .
__controlfp_s .text 00401822 00000006 R . . . . T .
__except_handler4_common .text 00401828 00000006 R . . . . . .
IsProcessorFeaturePresent(x) .text 0040182E 00000006 R . . . . T . |
Does not look good, isnt it? It's nothing even similar to all the crackme's I have already done so far.
My question is, how to get rid of all of this insignificant stuff and place only my functions in the foreground?
As always, any kind of help you provide will be greatly appreciated.
I am a professional graphic designer, not coder, programming is my passion so I would like to excuse for every stupid question I am trying to post.
|
|
| Back to top |
|
 |
Zanzer
I post too much
![]() Reputation: 126
Joined: 09 Jun 2013
Posts: 3278
|
| Posted: Sun Nov 01, 2015 4:17 pm Post subject: |
|
|
| I'm assuming you're compiling the code in a Debug Build instead of a Release Build? Fix that.
|
|
| Back to top |
|
|
ThereIsNoSpoon
How do I cheat?
![]() Reputation: 0
Joined: 27 Oct 2015
Posts: 8
Location: DWORD PTR
|
| Posted: Mon Nov 02, 2015 12:07 am Post subject: |
|
|
I am using Release Win32 settings to compile my stuff.
I've somewhat solved my problem by exporting functions and compiling into DLL's.
|
|
| Back to top |
|
|
STN
I post too much
 Reputation: 43
Joined: 09 Nov 2005
Posts: 2676
|
| Posted: Mon Nov 02, 2015 8:54 am Post subject: |
|
|
These are VC libraries. Use windows API instead of console and your output should be similar to the crackmes you see.
When you generate in Debug mode, you can get a nice pdb file that Ollydbg can use and will tell you what each asm instruction stands for what code in C++. VC can debug itself if you include browse information from compiler settings.
This is indeed a great way to learn.
_________________
|
|
| Back to top |
|
|
ThereIsNoSpoon
How do I cheat?
![]() Reputation: 0
Joined: 27 Oct 2015
Posts: 8
Location: DWORD PTR
|
| Posted: Mon Nov 02, 2015 1:52 pm Post subject: |
|
|
Many thanks for your reply STN.
I did some research, searching for the most basic definition of windows API application and that is what came to my mind after reading all of the stuff.
WinMain.cpp
| Code: | #include <Windows.h>
int WINAPI WinMain(HINSTANCE hThisInstance,
HINSTANCE hPrevInstance,
LPSTR lpszCmdLine,
int iCmdShow)
{
MessageBox(0, "asdasdas", "qweqweqwe", MB_OK);
} |
Is this what we've been looking for?
If so, then I am missing something really crucial.
Let me quickly describe what I've been doing so far.
1) no matter how do I try to create new project in VC++ 2013:
- FILE -> NEW -> PROJECT -> EMPTY PROJECT,
- FILE -> NEW -> PROJECT -> WIN32 PROJECT:
+ windows or console application
+ empty project or not
+ precompiled headers or not
+ Security Development Lifecycle (SDL) checks or not
2) PROPERTIES -> LINKER -> SYSTEM -> SUBSYSTEM
- console
- windows
3) compliling into:
- release Win32
- debug Win32
- keep or delete PDB files before analyse
I am always getting tons of crap in IDA.
| Code: | WinMain(x,x,x,x) .text 00401000 00000017 R . . . . T .
__security_check_cookie(x) .text 00401017 0000000F R . . . . T .
pre_c_init .text 00401026 000000B9 R . . . . T .
pre_cpp_init .text 004010DF 0000004B R . . . . . .
_WinMainCRTStartup .text 0040112A 0000000A R . L . . T .
__tmainCRTStartup .text 00401134 000001B4 R . . . B T .
___raise_securityfailure .text 004012E8 0000003D R . . . B T .
___report_gsfailure .text 00401325 000000FB R . . . B . .
__CxxUnhandledExceptionFilter(_EXCEPTION_POINTERS *) .text 00401420 00000040 R . . . B T .
___CxxSetUnhandledExceptionFilter .text 00401461 0000000E R . . . . T .
__XcptFilter .text 00401470 00000006 R . . . . . .
__amsg_exit .text 00401476 00000006 R . . . . . .
__FindPESection .text 00401480 00000043 R . . . B T .
__IsNonwritableInCurrentImage .text 004014D0 000000BA R . . . B T .
__ValidateImageBase .text 00401590 00000031 R . . . B T .
___security_init_cookie .text 004015C1 0000009C R . . . B . .
__setargv .text 0040165D 00000003 R . . . . T .
___atonexitinit .text 00401660 0000003C R . . . . T .
__onexit .text 0040169C 000000A9 R . . . B T .
_atexit .text 00401745 00000015 R . . . B T .
__RTC_Initialize .text 0040175A 00000020 R . . . . . .
__RTC_Terminate .text 0040177A 00000020 R . . . . T .
__setdefaultprecision .text 0040179A 00000028 R . . . . . .
__initterm_e .text 004017C2 00000006 R . . . . . .
__initterm .text 004017C8 00000006 R . . . . . .
__SEH_prolog4 .text 004017D0 00000045 R . L . . . .
__SEH_epilog4 .text 00401815 00000014 R . L . . . .
__except_handler4 .text 00401829 00000023 R . . . B T .
__crt_debugger_hook .text 0040184C 00000006 R . . . . . .
___crtUnhandledException .text 00401852 00000006 R . . . . . .
___crtTerminateProcess .text 00401858 00000006 R . . . . . .
terminate(void) .text 0040185E 00000006 . . . . . T .
___crtSetUnhandledExceptionFilter .text 00401864 00000006 R . . . . . .
__lock .text 0040186A 00000006 R . . . . . .
__unlock .text 00401870 00000006 R . . . . . .
___dllonexit .text 00401876 00000006 R . . . . . .
__invoke_watson .text 0040187C 00000006 R . . . . . .
__controlfp_s .text 00401882 00000006 R . . . . T .
__except_handler4_common .text 00401888 00000006 R . . . . . .
IsProcessorFeaturePresent(x) .text 0040188E 00000006 R . . . . T . |
I have also tried to use CodeBlocks instead of VC++ but things were not going any better.
Searching for crackme's source codes ended up in finding lots of ASM sources or dead links for c++ were servers were not responding.
Can I have a simple example of VC++ project so I can analyse and figure out all the properties and stuff to get that done, please?
I got this feeling, that I am getting blocked by something like: "press enter to continue", and I am looking at it and thinking about it but can't see its all about just hiting enter.
|
|
| Back to top |
|
|
atom0s
Moderator
 Reputation: 205
Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1
|
| Posted: Tue Nov 03, 2015 2:43 pm Post subject: |
|
|
You are not going through and optimizing your projects settings to remove unneeded things from the file. Instead you are just using the default settings which make use of various things like exception handling and so on.
For example, set the project to Release mode then open the properties of the project.
Some things you will want to adjust to remove some of the basic garbage is:
C/C++ -> General
- Turn off Debug Information Format (Set to none.)
- Turn off SDL checks.
C/C++ -> Optimization
- Here you can play with things to get varying degrees of output from the compiler. If you want things to be as literal to what you coded as possible, turn optimizations off.
C/C++ -> Code Generation
- Enable String Pooling to help with multiple of the same strings.
- Disable C++ Exceptions
- Disable Security Check
- Disable Control Flow Guard
- Disable Function-Level Linking (As you will not need edit and continue.)
C/C++ -> Precompiled Headers
- You can just disable these as you will more then likely not use them.
Linker -> Debugging
- Disable Generate Debug Info
This will disable a handful of the junk that gets compiled into the application. Next, if you want to remove the CRT and just use the enforced entry point, you can "reseat" the entry point by going to:
Linker -> Advanced
And set the 'Entry Point' to the one you use in your project. For example:
- For console projects, enter: main
- For window projects, enter: WinMain
- For dll projects, enter: DllMain
This is reseat the entry point and bypass the CRT initialization. This will remove all CRT usage in your application though unless you manually initialize it during runtime! So keep that in mind if you do it.
When you reseat the entrypoint, this should remove literally everything from your program except your code.
_________________
- Retired. |
|
| Back to top |
|
|
ThereIsNoSpoon
How do I cheat?
![]() Reputation: 0
Joined: 27 Oct 2015
Posts: 8
Location: DWORD PTR
|
| Posted: Wed Nov 04, 2015 10:38 am Post subject: |
|
|
Oh my god!
I owe you a big crate of beer or nice big bootle of good bourbon/whiskey as you wish.
Once again, in a matter of couple of days, you made my day once again!
This is exactly what I have been looking for, I am so pFkn* excited.
Even my girlfriend has already noticed that something is in the air. She does not understand what or why is going on yet, but she already know that I'll be gone for another couple of weeks, haha!
Just sitting there, apparently doing nothing, stearing at code, smiling to myself and trying to think out of the box! PRICELESS.
But honestly, I reallly appreciate what you are doing for me.
Thanks man.
btw. you are creating another small atom0s ]:>
I was about the send you PM but unfortunately, I am not allowed to do this.
Please check for what is hiding in my post 
Hey mate,
I really do appreciate what you have already done for me. This is no joke.
I am a graphic designer and graphic department manager at well know european company producing professional sportswearing clothes.
Do you ride a bike, jogging everyday morning, or doing any kind of stuff I can help you with getting top most quality clothes? Just let me know, please.
Or maybe you need help with some graphic design, leaflets, vouchers, anything
I'll be here, to help you.
And I'll be glad and happy to help you.
| Shrooms wrote: | you sure that's most 'basic' in terms of creating a window?
msdn . microsoft . com/en-us/library/windows/desktop/ms644977%28v=vs.85%29.aspx |
The most basic in terms of creating windows API code.
Thanks for the link anyway, you just gave me another thing to learn about.
Appreciated.
* don't know why, but I was advised that I can't double post, and had to change "u" -> "you".
Last edited by ThereIsNoSpoon on Wed Nov 04, 2015 12:54 pm; edited 2 times in total |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
