Log in

View Full Version : reversing a c++ struct from debugger


malware
May 19th, 2010, 16:48
i am trying reversing at these times, i have poor asm knowledge but i keep learning since i am interested. for now i am curious about reversing c++ structs, i wonder if i need olly debugger or ida to do that, or maybe some plugin that makes that automatically. anyways i would like to reverse it directly from memory and convert to c++ code. anyone has some tips about this?

Kayaker
May 19th, 2010, 21:27
I would suggest that IDA is best suited to creating new structures with a static analysis. You don't necessarily have to use it as a debugger, you can use Olly for that if you prefer, to test structure offset memory values, etc.

IDA will allow you to create and modify a structure and then you can define structure offsets to see if they "make sense" as the definitions are propagated through the static dissasembly of the code.

Here's a small example of how it can be used

Using Structure Offsets as Symbolic Constants in IDA
http://malwareanalysis.com/CommunityServer/blogs/geffner/archive/2006/03/17/11.aspx