Analyze Arm Linux CPP binary in Ida Pro

Question

I tried to open CPP binary with Ida. Most of the code analyze well .

The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (offset) so Ida will analyze the functions that all the fields in vtable point on them.

In addition,the first function in Vtable is constructor ,and in that constructor we can see the vtable that this vtable inherits from. Ida didn't analyze the "father" vtable.

How can I fix this/or is there a script that do it as well to CPP Aem binary

Answer 1

as you mentioned in comments, you need to build class hierarchy or find vtables. Following are some projects that I know will help you in achieving what you would like.

1. classinformer - https://sourceforge.net/projects/classinformer/

2. Classy - https://github.com/RicBent/Classy

3. Hexpytools - https://github.com/igogo-x86/HexRaysPyTools

4. Also look @ this exellent publication, but their code base is not open sourced - https://dl.acm.org/doi/pdf/10.1145/3321705.3329833 (last time I asked them, they told me that they are planning to do so shortly)

Their paper is interesting to look at, as it explains how to recover such structures. Typically, you need, vtable entries, vtable structures, class constructor and destructor analysis and object flow analysis to build the desired hierarchy.