c++ reversing

[Shub-Nigurrath]

Hi all,

dunno if this went unnoticed or not, but it's definitely an interesting area to investigate further..for me surely it is..

OOP_RE" as described in:

http://www.blackhat.com/presentations/bh-d...al_Yason-WP.pdf

A lof more can be taken using the igorsk's great info and scripts here:

http://www.openrce.org/articles/full_view/23

[Externalist]

And of course, don't forget the C++ reversing section in "Hacker Disassembling Uncovered" by Kris Kaspersky.

[Hikaru]

It's an interesting topic for sure. There are few public tools to conduct oop reversing and seems that a lot of people is limited to use igor's scripts, naming convention (typical naming "ClassName__MethodName"), and many other tiny helper scripts like this one:

dvlabs.tippingpoint.com/.../mindshare-finding-object-constructors

Also the object reconstruction part is a pain in the a**, what people do you use for object/structure rebuilding? I usually mantain lists of references to [r32+offset], and then try to do offset and context matching but I'm pretty sure there are better ways to handle all this information.

It would be nice to work on the topic, even if it's only for a concrete compiler... keep us updated Shub

[Sirmabus]

And my IDA Pro plug-in "Class Informer" based on Igor Skochinsky's great article and scripts.
/>http://www.openrce.org/blog/view/1344/Class_Informer_IDA_plug-in

"Reversing Microsoft Visual C++ Part II: Classes, Methods and RTTI"
/>http://www.openrce.org/articles/full_view/23

Edited December 31, 2009 by Sirmabus

[atom0s]

Nice reads, thanks for the links.

[Sirmabus]

I updated "Class informer" and other plug-ins here along with some new ones: Sirmabus Plugin Page

[sloxer]

Nice doc,Thx