0

I have a complicated question to ask so I will try my best to be clear.

I have this binary I am trying to reverse that came with a pdb file. I have dumped the compilands of the binary to begin with.

I want to reproduce the source code of the binary as close to the original as possible so I see in the first compiland that somefile.obj(let's call it that) consists of ../file_path/somefile.cpp and ../compile_path/xlocale

I then dumped the line numbers for somefile.cpp and using ida pro as my disassembler and hex-rays decompiler as a guide.

From the source lines, hex-rays and some manual work I have managed to recreate somefile.cpp to the point that it's diasassembly is identical to the original file's one.

The somefile.cpp consists of an empty constructor and destructor and a few function implementations.

My problem is, the dumped compiland does not show a somefile.h as part of the object but the functions in somefile.cpp are methods of a somefile class (I got the entire class definition from the pdb). I can always create my own header file and put the class definition in there but that's not the purpose.

So, my question is: where does the original somefile.cpp get the class definition from? Is there a way I can get such information at all, or do I have to guess?

I am very sorry for the long text.

Improve this question

1 Answer 1

Reset to default
1

Depending on the original source, the class definition could be entirely in the header file. Class definitions are no longer useful in object files as the compiler already knows how fields and methods are laid out.

You have to guess the original definition. Keep in mind that you already have guessed a lot when reverting via hex-rey as C++ allows preprocessing, templating and macro expansion. This means that the types you are using are of the correct size, but have lost their semantic meaning that in the original source code they might have: e.g. custom typedefs are usually lost.

Improve this answer
2
  • Thank you for your answer. I guess my question was not well phrased. I know generally what the case is with class definitions, however the compilands dump does not show any header files used in compilation. So my question is int his specific example where was the class defined? If it was defined in the cpp file itself, wouldn't that be apparent in the line numbers dump? Or are these lines ignored? Thanks again!
    – ilias kavalis
    Commented Jan 4, 2020 at 22:37
  • 1
    Well, Header files are usually "definition" files and may be get lost during the translation into object files. I say "may" because I saw certain compilers completely omitting class data and netadata (in those cases rtti was not explicitly available). To my knowledge they can be simply omitted, and since you can step/break into assembly code only, your line numbers will refer to the portion of executable code, even if you write a class with method data into an header file. The hope to be a little bit clearer..
    – Yennefer
    Commented Jan 5, 2020 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.