Flag: Tornado! Hurricane!

Article Abstract Microsoft Visual C++ is the most widely used compiler for Win32 so it is important for the Win32 reverser to be familiar with its inner working. Being able to recognize the compiler-generated glue code helps to quickly concentrate on the actual code written by the programmer. It also helps in recovering the high-level structure of the program.

In part II of this 2-part article (see also: Part I: Exception Handling), I will cover how C++ machinery is implemented in MSVC, including classes layout, virtual functions, RTTI. Familiarity with basic C++ and assembly language is assumed.

Full Article ...    Printer Friendly ...

Article Comments
linestyle Posted: Thursday, September 21 2006 20:02.11 CDT
great work!!:)

MohammadHosein Posted: Friday, September 22 2006 15:23.54 CDT
actually didnt read the whole article yet , but seems very informative . the undocumented VC's switch was very interesting , would you like to share how did you find it and are there any other undocumented switches ? :)

igorsk Posted: Friday, September 22 2006 16:30.48 CDT
Well, I was disassembling c1xx to check how it does certain things and sort of stumbled upon it. There are a lot of hidden options, but I didn't really investigate them that much. Here's a page that has a huge list with some described:

dnix Posted: Tuesday, August 19 2008 03:32.23 CDT
wonder whether these structures found by these scripts could be added to the IDA structures so one choose them from add struct var

Sirmabus Posted: Wednesday, December 24 2008 00:45.52 CST
Thanks the vtable finder/namer script functionality is great help. In particular over a very large target with over a 1000 vtables.

I read the article some time ago, but finally got around to experimenting.
It's probably way over looked, people probably don't know how usefull it is on such targets with lots of vtables.  You have to try it to understand..

I think I may expand the idea into a plug-in and add some more features like a list/log window, etc.

Phenomenal work!

Sirmabus Posted: Thursday, January 22 2009 04:26.19 CST
<Here's my plug-in>

Externalist Posted: Thursday, January 29 2009 20:58.09 CST
I've also read this some time ago but never really got a chance to recognize the full power until recently when I got involved in a C++ reversing project.
This is truely awesome along with Part I of this article. I could say I gained tons from this. Thanks alot for the contribution!! And also, thanks for the plugin with extended features Sirmabus. :)

FloydTammie31 Posted: Sunday, September 12 2010 04:35.28 CDT
Houses are quite expensive and not everyone can buy it. Nevertheless, <a href="http://bestfinance-blog.com/topics/home-loans">home loans</a> are invented to support different people in such situations.

hwwh1999 Posted: Saturday, September 18 2010 10:04.12 CDT
Mark and study

tcljg2008 Posted: Saturday, December 18 2010 05:00.26 CST
very very good!

roczhang Posted: Thursday, March 3 2011 13:47.08 CST
Great paper. I have took almost two days to want to know the details how dynamic_cast work through RTTI.
I have tried to search some materials by google, but I failed. Because I don't know the key word, such as "RTTI Complete Object Locator".
So I try to do it by myself. I convert the C++ code to assemby code and find how the RTTI work.  Then I want to write it to share with others, but now I find your article.  Your artical is great! I feel I don't  need to write it any more.  Thank you.
Great artical.

qxsl2000 Posted: Wednesday, March 30 2011 03:47.06 CDT
it seems like c++ object hierarchy to be decomplied but disassemble through some tricks, this is incredible job, for ours aspiring c++ programmers.thank you so much!

EliteKnites Posted: Tuesday, May 10 2011 02:03.28 CDT
Thank you so much.. this paper gives a clear cut idea of RTTI and how the internal implementation is..
This gives me more interest on RTTI

EliteKnites Posted: Tuesday, May 10 2011 02:06.48 CDT
i have some doubts on this.. typeid is returning const type_info&.. but in type_info class implementation copy constructor and equalto operator is private mode how it is returning reference to us? can any one explain me about this ?

martinkro Posted: Tuesday, July 19 2011 06:58.50 CDT
great artical ,thank you!!

Shine Posted: Thursday, August 4 2011 21:23.55 CDT
good articleŁ¬by what method do you trace it?

julyDragon919 Posted: Tuesday, August 7 2012 07:27.30 CDT
you ve just made me smile!
i was having a long face before seeing your article.
thanks! it was, is , will be helpful!

cl001 Posted: Monday, May 6 2013 02:13.31 CDT
Lululemon Outlet numbers Fashion Lululemon Sale styles of Lululemon UK cheap.

Add New Comment

There are 31,302 total registered users.

Recently Created Topics
[help] Unpacking VMP...
Reverse Engineering ...
let 'IDAPython' impo...
set 'IDAPython' as t...
GuessType return une...
About retrieving the...
How to find specific...
How to get data depe...
Identify RVA data in...

Recent Forum Posts
Finding the procedur...
Question about debbu...
Identify RVA data in...
let 'IDAPython' impo...
How to find specific...
Problem with ollydbg
How can I write olly...
New LoadMAP plugin v...
Intel pin in loaded ...
OOP_RE tool available?

Recent Blog Entries
Breaking IonCUBE VM

Anatomy of a code tracer

IAT Patcher - new tool for ...

CryptoShark: code tracer ba...

Build a debugger in 5 minutes

More ...

Recent Blog Comments
nieo on:
IAT Patcher - new tool for ...

djnemo on:
Kernel debugger vs user mod...

acel on:
Kernel debugger vs user mod...

pedram on:
frida.github.io: scriptable...

capadleman on:
Using NtCreateThreadEx for ...

More ...

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit