0

I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in the past for this library, I noticed that I couldn't search for C++ classes the same way I do with IDA's Ctrl+L.

IDA's output:

IDA Output

If I search in Cutter's "Symbols" tab:

Cutter symbols

There is also a "VTable" tab, which also looked interesting since it's basically what I am looking for, but although it shows about 1k VTables, none of them have any kind of name:

Cutter VTable

2 Answers 2

0

The class names come from RTTI descriptors embedded in the binary.

Consider this simple example of retrieving the class of an object at runtime:

#include <iostream>
#include <typeinfo>

class Base {
public:
    virtual void vvfunc() {}
};

using namespace std;
int main() {
    Base* pb = new Base;
    // class Base
    cout << typeid(*pb).name() << endl;
    // .PEAVBase@@
    cout << typeid(pb).raw_name() << endl;   
    delete pb;
}

The second line of the output is a decorated class name - the symbol names used to name VTables are stored in the exact same format. Note that binaries can be stripped off type information at compile time.

An example IDA tool for structuring and parsing RTTI is ClassInformer plugin.

1
  • I have used ClassInformer before, although not for this project, since it only works for windows binaries. While searching around some time ago I saw that since some version ago, IDA has integrated support for RTTI, and I am guessing that's why those names show up in Ctrl+L. I will mark this answer as solved because it contains useful information, but my original issue was that there is a "Classes" window in Cutter that displays all these classes.
    – trxgnyp1
    Aug 24, 2023 at 12:26
0

Turns out that Cutter actually provides RTTI information, but not under the "Symbols" window but under another "Classes" window that is hidden by default.

You can open it from Windows > Info > Classes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.