3

I imported my exe file in OllyDB and when I searched for the names(labels) present, I was able to see all the function declarations, class names etc. I didn't have my PDB in the EXE path. Why does this occur? Should I enable some obfuscation settings during my build?

  • Was the .pdb in the search path? – Nordwald Dec 7 '16 at 9:47
  • No, the PDB was not in the search path. – Kaushik Ramachandran Dec 7 '16 at 9:56
  • Are you using RTTI ? – w s Dec 7 '16 at 11:03
  • Yes, I have used dynamic_cast<> in my code. But is that an issue? – Kaushik Ramachandran Dec 7 '16 at 11:08
  • Yes, it is probably the issue and definitely should be at least part of it. Would you post some examples of suspicious strings that you see in the code ? – w s Dec 7 '16 at 11:12
5

dynamic_cast requires a runtime check that the cast is valid at execution time and the usual implementation uses RTTI (Run-time type information) attached to all classes participating in the casts. However, since it's not easy to narrow down the classes that may be possibly casted, in practice the compiler emits RTTI for all polymorphic classes (i.e. those that have virtual methods). While the RTTI details are not specified by the C++ standard, the Visual C++ implementation retains full class names. You can find more details in my article on the topic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.