3 ms·

I tried reversing a medium-complexity program, but after a long time of digging through seemingly nonsensical data structures, it seemed very clear to me that i

I tried reversing a medium-complexity program, but after a long time of digging through seemingly nonsensical data structures, it seemed very clear to me that it was a C++ program and the pointery mess I was seeing was likely a result of classes and inheritance. Has Ghidra gotten better at dealing with those, and is there a good tutorial how to best handle it?

kortilla 5y ago
Classes and inheritance shouldn’t really have an impact on pointers though.
- jussij 5y ago
  I suspect the OP is referring to the fact C++ uses vtables which means function calls and object layout make heavy use of pointers.
  - tgsovlerkhgsel 5y ago
    Thank you! It was a while since I last touched the project, this is exactly what I meant. It gets really confusing if you aren't aware of the concept.
- st_goliath 5y ago
  In C++ you have an implicit this pointer passed to methods, so for a start, something like this: instance.Method(foo); .... SomeClass::Method(int x) { y += x; } more or less translates to something like this (using a pseudo C level here, rather than assembly): Method(&instance, foo); .... Method(SomeClass *this, int x) { this->y += x; } it gets more interesting if "SomeClass::Method" is virtual, in which case the call looks more like this: (((BaseClass *)&instance)->vtable.Method)(&instance, foo); Where "vtable" is a compiler generated struct with function pointers. So here's your "pointery mess", neatly abstracted away by the syntax in the first example. With multiple inheritance, it gets a bit more hairy than this, because the compiler has to do some offset adjustments on the casted pointer to get at the right vtable.
  - quietbritishjim 5y ago
    Although rare, virtual inheritance (used in multiple inheritance) makes things even worse because even "this" needs to be found through a vtable! So you get another level of indirection. I was going to illustrate with an example like yours but I couldn't figure my way out through all the bits (including the virtual-base offsets in the vtable, or the VTT which is a table of vtables!).
- steerablesafe 5y ago
  I think they meant virtual function calls, that manifests in indirect calls.
bluesign 5y ago
I am reversing for almost 25-30 years, a lot of things have changed in those years, especially compilers and optimizations. It is hard to give advice, as I learned gradually. But I think best advice is aggressive labeling of the functions with their intent I guess. It is very similar to jigsaw puzzle, more pieces you put it is easier to put next.
- iou 5y ago
  Jigsaw puzzle is a great analogy, specifically in reference to IDA.
chc4 5y ago
tldr kinda. The most recent version of Ghidra has a plugin to try and construct classes via RTTI info. This still only helps if your binary has RTTI (e.g. there's a dynamic_cast anywhere) and Ghidra still doesn't handle OOP that well even with it. There are other community plugins on Github for the same type of thing. For heavy C++ binaries, IDA and BinaryNinja handle them a lot better, with the decompiled code looking like normal C++. You still can use Ghidra, it just means you have to do manual recognition of `this` pointers and virtual calls more.

kortilla 5y ago

Classes and inheritance shouldn’t really have an impact on pointers though.

jussij 5y ago
I suspect the OP is referring to the fact C++ uses vtables which means function calls and object layout make heavy use of pointers.
- tgsovlerkhgsel 5y ago
  Thank you! It was a while since I last touched the project, this is exactly what I meant. It gets really confusing if you aren't aware of the concept.
st_goliath 5y ago
In C++ you have an implicit this pointer passed to methods, so for a start, something like this: instance.Method(foo); .... SomeClass::Method(int x) { y += x; } more or less translates to something like this (using a pseudo C level here, rather than assembly): Method(&instance, foo); .... Method(SomeClass *this, int x) { this->y += x; } it gets more interesting if "SomeClass::Method" is virtual, in which case the call looks more like this: (((BaseClass *)&instance)->vtable.Method)(&instance, foo); Where "vtable" is a compiler generated struct with function pointers. So here's your "pointery mess", neatly abstracted away by the syntax in the first example. With multiple inheritance, it gets a bit more hairy than this, because the compiler has to do some offset adjustments on the casted pointer to get at the right vtable.
- quietbritishjim 5y ago
  Although rare, virtual inheritance (used in multiple inheritance) makes things even worse because even "this" needs to be found through a vtable! So you get another level of indirection. I was going to illustrate with an example like yours but I couldn't figure my way out through all the bits (including the virtual-base offsets in the vtable, or the VTT which is a table of vtables!).
steerablesafe 5y ago
I think they meant virtual function calls, that manifests in indirect calls.

bluesign 5y ago

I am reversing for almost 25-30 years, a lot of things have changed in those years, especially compilers and optimizations. It is hard to give advice, as I learned gradually. But I think best advice is aggressive labeling of the functions with their intent I guess. It is very similar to jigsaw puzzle, more pieces you put it is easier to put next.

iou 5y ago
Jigsaw puzzle is a great analogy, specifically in reference to IDA.

chc4 5y ago

tldr kinda. The most recent version of Ghidra has a plugin to try and construct classes via RTTI info. This still only helps if your binary has RTTI (e.g. there's a dynamic_cast anywhere) and Ghidra still doesn't handle OOP that well even with it. There are other community plugins on Github for the same type of thing. For heavy C++ binaries, IDA and BinaryNinja handle them a lot better, with the decompiled code looking like normal C++. You still can use Ghidra, it just means you have to do manual recognition of `this` pointers and virtual calls more.