3 ms·
Been working on a few reverse engineering projects myself and it's a great refreshing experience when you can find a tool that outputs a good approximation of w
by jamesu 8y ago
Been working on a few reverse engineering projects myself and it's a great refreshing experience when you can find a tool that outputs a good approximation of what the original code was doing, even if the approximation is terrible. Modern compilers seem to love to move around registers, use one-off instructions, pad everything, stick nops in everywhere, etc.
Also vtables are an extreme pain. What's function 0x10? Just gotta guess or try and inspect it at runtime.
- banachtarski 8y ago> love to move around registers Using -O2? I would imagine register moving is done in this case out of necessity due to either call conventions, syscall conventions, loop semantics, etc > Pad everything/stick nops everywhere Yes and I'm glad they do. Branching to a non 16-byte aligned address is much slower. Accessing misaligned data is slower too.
- XMPPwocky 8y agoFor vtables, generally you can follow the object up the call chain until you find its constructor/initializer. Then you see the actual vtable and define it as a struct; now you have method names.