23

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the object types expected by the this pointer in virtual functions, and sometimes map out a class hierarchy.

In the context of static analysis, what tools or annotation techniques do you use to make virtual functions simpler to follow in your disassembly? Solutions for all static analysis toolkits are welcome.

Improve this question

1 Answer 1

Reset to default
24

I gave a talk at Recon in 2011 ("Practical C++ Decompilation") on this exact topic. Slides and video (mirror) are available.

The basic approach is simple: represent classes as structures, and vtables as structures of function pointers. There are some tricks I described that allow you to handle inheritance and different vtables for the classes in the same hierarchy. These tricks were also described on this blog; I'm not sure if it was based on my talk or an independent work.

One additional thing that I do is add a repeatable comment to each slot in the vtable structure with the implementation's address. This allows you to quickly jump to the implementation when you apply the structure to the vtable slot load:

enter image description here

Improve this answer
3
  • Questions about this: 1) How do you (personally) annotate indirect calls when the vtable being referenced is undetermined? (more specifically, when there are multiple possible target addresses for the call?) 2) How do you (personally) name your class structures before determining their purpose, and how far do you let their temporary names propagate throughout the database before you change them?
    – user1354557
    Mar 21, 2013 at 20:02
  • I (usually) create one vtable struct per actual vtable instance, so the addresses always point to the actual implementation. However, nothing stops you from adding several addresses to the comment. As for naming, I don't really have a fixed rule set, I can mix Hungarian, CamelCase and undescored_words in the single database. Re-renaming stuff is annoying, so I usually defer renaming classes and methods until I'm reasonably sure what the class is doing (or have RTTI or debugging info).
    – Igor Skochinsky ♦
    Mar 21, 2013 at 20:08
  • Excellent. Regarding the second question, I was asking if you had some systematic way of generating and handling temporary names. In the absence of contextual information, what I do is choose a "random" phonetic three-character name for the class. Since this temporary name propagates to comments, function names, structure members, variable names, etc. I won't always bother with renaming, but I'll instead make a note in the Notepad subview that explains what the class actually is.
    – user1354557
    Mar 21, 2013 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.