📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Determining Size of Buffers

Topic created on: May 17, 2007 20:18 CDT by jms .

Newb question:

I just created a simple C++ app that uses a memcpy() so I can see how it works, and practice my RE foo. The question is this, through a straight hook you will get the *source, *dest, and the size which is fine, but is there a way that you would be able to determine the size of the src/dest based on where they point? Anyone ever done something like that?

  PSUJobu     May 18, 2007 08:00.10 CDT
I generally end up tracking the src / dest back (up the call stack) to where they are allocated. If one of them is statically allocated, it is a bit trickier - IDA (for example) might have enough data references to give you an accurate picture of the size (e.g., next data item referenced leaves 256 bytes or some other "round" number). This is not always the case, though.

Sometimes you are lucky enough (in the real world - obviously doesn't apply to your sample) that the buffer is cleared first (e.g., memset(buffer, 0, sizeof(buffer))) so the code itself has the information.

One final comment on C++ RE foo: An OO C++ app can be much harder to analyze (statically, at least) when virtual functions are involved. In that case, your "call stack" only gets you back to the vtable. If dynamic analysis (debugger or the like) is not available, it can be quite time-consuming to figure out where the virtual functions are invoked. This difficulty increases exponentially with the size and complexity of the application. It'd be far easier on Wintel or other "PC" environments where you can get runtime information.

EDIT: "Far easier" does not mean "easy." Dynamic binding is a tough problem, regardless, but is far more challenging for purely static analysis ("brute force" reverse engineering).

  jms     May 18, 2007 08:41.46 CDT
I appreciate your comments, I am going to see what I can come up with.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit