3

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long since unmaintained, there is nowhere to get support by now).

These binaries do not make use of 3rd party libraries, only VC++ runtime and Win32 API and hence make heavy use of STL containers.

It was quite easy to create general-purpose IDA struct definitions for things like std::vector or std::string. However, these binaries do have plenty of std::map usages, and well, the way msvc generates assembly for std::maps is particularly annoying.

Namely, the whole binary is stuffed with countless methods to allocate map entries (one method per map<k, v>), the entries all have different sizes, with the entry structure having the same few fields at the beginning and the end and a variable sized middle part. All the methods that are used on a particular map (e.g. find) are thus then generated with regards to these entry types, so it is a huge pain to manage this.

I can infer the underlying logic in many cases where a map is being accessed, but I still would prefer to have a struct/many structs for better readability, preferably not needing to manually define literally all of the different structs.

If someone could share their own experience/findings related to reversing a large amount of std::maps efficiently, that would be great.

  • 3
    welcome to the horrors of template-based programming! :) – Igor Skochinsky Oct 5 '17 at 17:25
  • Somehow, I expected there might be no better option. Still, one can hope :). Noticed that I somehow forgot to add compiler info. - that's fixed now. – afk5min Oct 5 '17 at 18:27

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.