OpenRCE Article Comments:
Reversing Microsoft Visual C++ Part II: Classes, Methods and RTTI
Microsoft Visual C++ is the most widely used compiler for Win32 so it is important for the Win32 reverser to be familiar with its inner working. Being able to recognize the compiler-generated glue code helps to quickly concentrate on the actual code written by the programmer. It also helps in recovering the high-level structure of the program.
In part II of this 2-part article (see also:
Part I: Exception Handling
), I will cover how C++ machinery is implemented in MSVC, including classes layout, virtual functions, RTTI. Familiarity with basic C++ and assembly language is assumed.
Full Article ...
Printer Friendly ...
Posted: Thursday, September 21 2006 20:02.11 CDT
Posted: Friday, September 22 2006 15:23.54 CDT
actually didnt read the whole article yet , but seems very informative . the undocumented VC's switch was very interesting , would you like to share how did you find it and are there any other undocumented switches ? :)
Posted: Friday, September 22 2006 16:30.48 CDT
Well, I was disassembling c1xx to check how it does certain things and sort of stumbled upon it. There are a lot of hidden options, but I didn't really investigate them that much. Here's a page that has a huge list with some described:
Posted: Tuesday, August 19 2008 03:32.23 CDT
wonder whether these structures found by these scripts could be added to the IDA structures so one choose them from add struct var
Posted: Wednesday, December 24 2008 00:45.52 CST
Thanks the vtable finder/namer script functionality is great help. In particular over a very large target with over a 1000 vtables.
I read the article some time ago, but finally got around to experimenting.
It's probably way over looked, people probably don't know how usefull it is on such targets with lots of vtables. You have to try it to understand..
I think I may expand the idea into a plug-in and add some more features like a list/log window, etc.
Posted: Thursday, January 22 2009 04:26.19 CST
<Here's my plug-in>
Posted: Thursday, January 29 2009 20:58.09 CST
I've also read this some time ago but never really got a chance to recognize the full power until recently when I got involved in a C++ reversing project.
This is truely awesome along with Part I of this article. I could say I gained tons from this. Thanks alot for the contribution!! And also, thanks for the plugin with extended features Sirmabus. :)
Posted: Sunday, September 12 2010 04:35.28 CDT
Houses are quite expensive and not everyone can buy it. Nevertheless, <a href="http://bestfinance-blog.com/topics/home-loans">home loans</a> are invented to support different people in such situations.
Posted: Saturday, September 18 2010 10:04.12 CDT
Mark and study
Posted: Saturday, December 18 2010 05:00.26 CST
very very good!
Posted: Thursday, March 3 2011 13:47.08 CST
Great paper. I have took almost two days to want to know the details how dynamic_cast work through RTTI.
I have tried to search some materials by google, but I failed. Because I don't know the key word, such as "RTTI Complete Object Locator".
So I try to do it by myself. I convert the C++ code to assemby code and find how the RTTI work. Then I want to write it to share with others, but now I find your article. Your artical is great! I feel I don't need to write it any more. Thank you.
Posted: Wednesday, March 30 2011 03:47.06 CDT
it seems like c++ object hierarchy to be decomplied but disassemble through some tricks, this is incredible job, for ours aspiring c++ programmers.thank you so much!
Posted: Tuesday, May 10 2011 02:03.28 CDT
Thank you so much.. this paper gives a clear cut idea of RTTI and how the internal implementation is..
This gives me more interest on RTTI
Posted: Tuesday, May 10 2011 02:06.48 CDT
i have some doubts on this.. typeid is returning const type_info&.. but in type_info class implementation copy constructor and equalto operator is private mode how it is returning reference to us? can any one explain me about this ?
Posted: Tuesday, July 19 2011 06:58.50 CDT
great artical ,thank you!!
Posted: Thursday, August 4 2011 21:23.55 CDT
good articleŁ¬by what method do you trace it?
Posted: Tuesday, August 7 2012 07:27.30 CDT
you ve just made me smile!
i was having a long face before seeing your article.
thanks! it was, is , will be helpful!
Posted: Monday, May 6 2013 02:13.31 CDT
Add New Comment
total registered users.
Recently Created Topics
Career: Malware Reve...
How to produce separ...
How to decompile a f...
How to trap mouse cl...
Intel pin in loaded ...
Going to do today wi...
how to create delphi...
enabling menu in a s...
How to get the Image...
OllyDBG Process Term...
Recent Forum Posts
Intel pin in loaded ...
OOP_RE tool available?
OOP_RE tool available?
Should binaries be n...
Problem with ollydbg
looking for a softwa...
.orpc section what's...
Pydbg load() issue
Recent Blog Entries
IAT Patcher - new tool for ...
CryptoShark: code tracer ba...
Build a debugger in 5 minutes
frida.re 1.2.0 is out, with...
Android Malware Analysis
Recent Blog Comments
Using NtCreateThreadEx for ...
Branch tracing and LBR acce...
Advanced debugging techniques
2 anti-trace mechanisms spe...
Jun 6, 2008