I imported my exe file in OllyDB and when I searched for the names(labels) present, I was able to see all the function declarations, class names etc. I didn't have my PDB in the EXE path. Why does this occur? Should I enable some obfuscation settings during my build?
-
Was the .pdb in the search path?– NordwaldDec 7, 2016 at 9:47
-
No, the PDB was not in the search path.– Kaushik RamachandranDec 7, 2016 at 9:56
-
Are you using RTTI ?– w sDec 7, 2016 at 11:03
-
Yes, I have used dynamic_cast<> in my code. But is that an issue?– Kaushik RamachandranDec 7, 2016 at 11:08
-
Yes, it is probably the issue and definitely should be at least part of it. Would you post some examples of suspicious strings that you see in the code ?– w sDec 7, 2016 at 11:12
|
Show 3 more comments
1 Answer
dynamic_cast requires a runtime check that the cast is valid at execution time and the usual implementation uses RTTI (Run-time type information) attached to all classes participating in the casts. However, since it's not easy to narrow down the classes that may be possibly casted, in practice the compiler emits RTTI for all polymorphic classes (i.e. those that have virtual methods). While the RTTI details are not specified by the C++ standard, the Visual C++ implementation retains full class names. You can find more details in my article on the topic.
answered Dec 8, 2016 at 20:21
