I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long since unmaintained, there is nowhere to get support by now).
These binaries do not make use of 3rd party libraries, only VC++ runtime and Win32 API and hence make heavy use of STL containers.
It was quite easy to create general-purpose IDA
struct definitions for things like
std::string. However, these binaries do have plenty of
std::map usages, and well, the way msvc generates assembly for
std::maps is particularly annoying.
Namely, the whole binary is stuffed with countless methods to allocate map entries (one method per
map<k, v>), the entries all have different sizes, with the entry structure having the same few fields at the beginning and the end and a variable sized middle part. All the methods that are used on a particular map (e.g.
find) are thus then generated with regards to these entry types, so it is a huge pain to manage this.
I can infer the underlying logic in many cases where a map is being accessed, but I still would prefer to have a struct/many structs for better readability, preferably not needing to manually define literally all of the different structs.
If someone could share their own experience/findings related to reversing a large amount of
std::maps efficiently, that would be great.