Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   STL and IDA Pro/HexRays? (https://forum.exetools.com/showthread.php?t=19646)

jonwil 09-08-2020 20:22

STL and IDA Pro/HexRays?
 
Does anyone have any tips for how to work with the STL (std::wstring, std::pair, std::vector, std::deque, std::multimap in particular seem to be used by my target based on its symbols) in IDA? How to figure out what the actual layout of a given STL class looks like? (once you expand out the template parameters) How to recognize inlined STL functions? Or any other tips for worknig with the STL in IDA

chants 09-09-2020 01:09

I imagine only pretty trivial STL functions would be inlined. Especially in modern variants the library gets quite complicated especially in debug builds. But iterators and such are almost surely inlined in release builds. But there is hardly anything to recognize there just pointers being incremented or dereferenced.

Inherently, the basic task of a decompiler is to deal with the control flow and data flow and produce some exact proper representation in C code. Everything and I mean everything C++ related can be done merely by pattern recognition algorithms. Its basically just a code cleanup phase. Of course pattern recognition may not always be the ideal or least complex approach but theoretically it should work. Practically speaking, simply reversing the way the compiler translate C++ code into C code in a more algorithmic way would also be a good idea.

In the context of IDA, dealing with anything C++ ideally you would look for plugins or write your own which does some sort of pattern matching or algorithmic identification. If going the algorithm route, it would really help to be an expert in some open source compiler frameworks like LLVM or GCC or something to know how and why those algorithms work, so as to have a hope of reversing them.

vic4key 10-17-2020 04:07

Take a look at `Options \ Demangled names...` It might help you to look STL asm codes more pretty.


All times are GMT +8. The time now is 20:00.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX