3

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long since unmaintained, there is nowhere to get support by now).

These binaries do not make use of 3rd party libraries, only VC++ runtime and Win32 API and hence make heavy use of STL containers.

It was quite easy to create general-purpose IDA struct definitions for things like std::vector or std::string. However, these binaries do have plenty of std::map usages, and well, the way msvc generates assembly for std::maps is particularly annoying.

Namely, the whole binary is stuffed with countless methods to allocate map entries (one method per map<k, v>), the entries all have different sizes, with the entry structure having the same few fields at the beginning and the end and a variable sized middle part. All the methods that are used on a particular map (e.g. find) are thus then generated with regards to these entry types, so it is a huge pain to manage this.

I can infer the underlying logic in many cases where a map is being accessed, but I still would prefer to have a struct/many structs for better readability, preferably not needing to manually define literally all of the different structs.

If someone could share their own experience/findings related to reversing a large amount of std::maps efficiently, that would be great.

  • 3
    welcome to the horrors of template-based programming! :) – Igor Skochinsky Oct 5 '17 at 17:25
  • Somehow, I expected there might be no better option. Still, one can hope :). Noticed that I somehow forgot to add compiler info. - that's fixed now. – afk5min Oct 5 '17 at 18:27
  • Related: reverseengineering.stackexchange.com/questions/3889/… And yeah, I don't know any automagics here to help you too. I always write code using the STL methods that come in question, compile it with the exact same toolchain as the original executable, hope they didnt use whole program optimizations, and compare both. It's tiresome, repetitive, and unthankful work, but if some code really breaks your mind, the only way to help you out of the dire situations. – Ray Koopa Mar 22 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.