2

how do I go around figuring out where to reverse engineer a struct?

As shown in the picture below, I have this function called "struct dynamic_array" which I want to reverse engineer and reimplement in C#, but I can't seem to find out where to look for it inside of IDA Pro?

Highlighting it doesn't give me any options and it doesn't show up anywhere, if I could get guidance on where to find it that would be highly appreciated.

The most help I got from an experienced friend was that it's a simple implementation of std::vector, so now I know a little about it

https://i.stack.imgur.com/JC4f5.png

1 Answer 1

2

The function's name isn't struct dynamic_array. The function's name is Mesh::CalculateBoneBindPoseBounds.

The function accepts an argument of type struct dynamic_array<...>.

There's no function named dynamic_array, as it's simply as structure defined within the binary. The name does imply we're dealing with an std::vector-like object, so I'd start with assuming that's the case for now and reverse engineer the function you're interested in particularly.

If you wish to reverse engineer the structure itself and functions related to the dynamic_array structure, you should look for a constructor to start with.

Highlighting won't work because that isn't the function's full name but browsing through IDA's function / name list view, you may be able to locate functions named struct dynamic_array. Depending on implementation, functionality and compilation parameters some or most functions may be inlined, preventing you from finding a function definition to reverse.

In case this is C code (or C style within C++ code) functions might not be named for the object they're implementing, although this doesn't seem to be the case, as evident by the naming convention.

Regardless of whether functions are inlined or whether they're implemented as struct/class methods or bare functions, after finding the major implementation functions for the structure you should start by mapping the structure's members. Their sizes, types and meaning by reverse engineering the different functions. After most of the members are clear, naming related functions shouldn't be too difficult.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.