While reading some threads on other reverse engineering forums, I learned that executable programs compiled in Delphi have special properties. I'm not sure what those special properties are but I think it somehow makes them harder to reverse engineer. Does anyone know what these special properties are?
Delphi uses an object-oriented language based on Pascal, it is similar in many ways to reversing C++. Here are some things specific to Delphi that I found important to know when reversing such applications.
Libraries and required functions from the RTL (Delphi Run Time Library) are usually statically compiled in the application binary. This results in large binaries with a large number of functions. Components code is usually placed at the beginning of the executable by the compiler and user code is placed after. Properly identifying and naming library functions can save you a lot of time, if using IDA make sure the appropriate FLIRT signatures are applied (probably one of the bds signature for recent applications). IDR also has its own set of signatures and can sometimes provide other useful information like class names and decompiled code. It is possible to export data from IDR to an IDC script and load it in IDA, the IDA signatures should be reapplied after as the IDC will remove some function names.
The RTL is well documented on the website of Embarcadero which bought Delphi (don't waste your time searching on the Borland website).
Delphi uses the fastcall convention, however it is different than Windows fastcall. The parameters are passed in this order : EAX, EDX, ECX, the others on the stack. For classes, the this pointer is passed in EAX. When a constructor is called, the structure of the class is passed in EAX and the this pointer is returned in EAX. Constructors can be identified as they call System::ClassCreate().
Delphi uses Pascal-style strings. The length of the string is specified at the start of the string. Strings stored in the binary file are in C-style format, they first need to be converted by calling the LStrAsg method. To know where strings are used in the program you need to follow the converted string, a typical call will look like this:
mov eax, ds:off_497050 ; Pascal string mov edx, offset a1_37 ; C-style string "1.37" call @System@@LStrAsg$qqrpvpxv ; System::LStrAsg(void*,void*)
There are many Delphi-specific "programming elements" such as classes, units, VCL libraries, etc. For more information, you may want to refer to A Beginner's Guide to Delphi Programming.
However, in terms of reverse engineering applications written in Delphi (and extracting information on these "programming elements"), the tool DeDe is invaluable.
When reverse engineering a Delphi/C++ builder target I always use the IDR tool. A very helpful feature is that IDR can generate a map file for Ida Pro.
IDR (Interactive Delphi Reconstructor) – a decompiler of executable files (EXE) and dynamic libraries (DLL), written in Delphi and executed in Windows32 environment.
The program firstly is intended for the companies, engaged by development of anti-virus software. It can also help programmers to recover lost source code of programs appreciably.
The current version of the program can process files (GUI and console applications), compiled by Delphi compilers of versions Delphi2 – DelphiXE2.
Final project goal is development of the program capable to restore the most part of initial Delphi source codes from the compiled file but IDR, as well as others Delphi decompilers, cannot do it yet. Nevertheless, IDR is in a status considerably to facilitate such process. In comparison with other well known Delphi decompilers the result of IDR analysis has the greatest completeness and reliability. Moreover interactivity does work with the program comfortable and (we shall not be afraid of this word) pleasant.
IDR make static analysis (analyzed file is not loaded to memory and executed) that allows to safely investigate viruses, trojans and other malware applications, those which executing is dangerous or is not desirable.
The program does not require any installation activity and does not do any records in Windows registry.
Below screenshot of IDR main window is shown. You can find examples of IDR working results on separate page. For detailed acquaintance with opportunities IDR there is a help file in format CHM which can be downloaded on page of download or directly from this link.