One Article Review
Accueil - L'article:
Source no_ico.webp MSReverse
Identifiant 8562118
Date de publication 2024-08-22 18:52:42 (vue: 2024-08-22 19:05:35)
Titre C ++ Metadata d'exception de détente: une aubaine de monnaie inverse cachée
C++ Unwind Exception Metadata: A Hidden Reverse Engineering Bonanza
Texte The worst part of reverse engineering C++ programs -- or really, any program that uses custom structure types with no definitions provided -- is that information about structures is often incomplete, sporadic, and isolated. Consider the following function: From this code, we can infer that rcx points to a struct that has a QWORD-sized field at offset +0x70. However, from this code alone, we don\'t know: The true type of the field at offset +0x70; The types and locations of any other fields; How big the struct is; Where else in the program the struct is used; Whether the struct contains any other structs, or is contained in any other structs. The most precise struct we can infer based upon this evidence is: struct sub_180013E60_arg_0 { char gap0[0x70]; _QWORD qw70; }; To obtain more information about the struct, we would need to go on a scavenger hunt looking at the callers of sub_180013E60 and following the pointer around the code to find other accesses. This procedure can easily lead to dead-ends, where the pointer is read from or written to another memory location, and we have no easy way of knowing what other parts of the code access that memory location; or if the function or its callers were declared virtual and hence called indirectly. In short, structure recovery is a tedious process that involves working with incomplete information most of the time, and gradually refining that information by finding other uses of the same structure type. This blog entry describes an overlooked source of information in C++ programs that can make manual and automated type reconstruction more efficient. More information about the data types used within a function is hiding in plain sight; we can exploit it if we simply know where to look and how to interpret it. Hex-Rays 9.0 contains built-in support to display this information -- namely, C++ exception wind and unwind metadata on MSVC/x64 targets -- naturally and automatically, directly in the decompilation listing. Background: C++ Exception Support Like other programming languages, C++ supports the notion of exceptions. The three relevant language keywords are throw, try, and catch. (Standard C++ does not have a finally keyword.) Upon encountering an exceptional situation, C++ code can use the throw keyword to raise a new exception. For example, consider the following function: void may_throw() { if ( rand() & 1 ) throw std::runtime_error("You lose"); } C++ code uses the try keyword to create a scope in which an exception may occur. try scopes have one or more catch blocks to catch specific types of exceptions. For example: try { may_throw(); printf("No exception\n"); } catch ( std::runtime_error &r ) { printf("Caught standard runtime_error %s\n", r.what()); } catch ( std::exception &e ) { printf("Caught stan
Notes ★★
Envoyé Oui
Condensat &e &r +0x70 +0x70; +72 +8: 0x10 0x20 0x30 0x70 180013e60 2024 810
l0 >l1 a::a a::~a able about absent access accesses accurate actual actually add added additional advance advantages after afterwards: akin all alloc allocate allocated allocation alone along also although always analysts analyzing ancestral and/or another any anywhere appear apply arbitrary are arg around aside assists assuming authored auto automated automatically background background: base based because been before begins behavior being below best beta between beyond big binary blob block blocks blocks: blog blurred body bonanza books both bottom boundaries breakpoints briefly building built but bypasses bytes c++ call called caller callers calling calls can cannot capable case catch catches catching caught cause causes caveats chain char chunks circumstance: circumstances clarify class class= classes cleanup clear clearer clearly click code come comes compiler complex complexities complexity comrat comrat: conclude conclusion concrete confirm consider construct constructed constructing constructor constructors constructs constructs: contained containers contains contents context control conversely correct corresponding could create created creating cross custom data dead deadlocks debugger decide declared decompilation decompilation: decompiler dedicated default defined definitions delete deleted depending deque describe describes describing despite destroy destroyed destroys destruct destructed destruction destructor destructor: destructors destructors: detailed details determine different differentiate directly disable disassembly discover discuss discussed display display; displaying does don doubly due earlier early easily easy effectively efficient element elements eliminate else emits emitted enable enabling enclosing encompasses encountering end ends engineered engineering ensure enters entry entrypoints error even event eventual evidence exactly example example: examples exception exceptional exceptions execute execution exist exit exits exn expect expense explicitly exploit extra fact failure familiar far features field fields fields; figure fill finally find finding first flow follow following following: follows: frames from full fully function function: functionality functions gain gap0 gap10 generally generated get gets give given gives giving glance gradually graph guard guru hallmarks handle handler handler: handlers handlers: happens happens: has have held help hence herb here here: hex hidden hide hiding highlighted holds how however hunt ida idb idea image immediately implementation implementing implements implicitly important including incomplete indirectly infer inform information informative informing inheritance initializes initializing inlined inlining inner insert inserted inserts installed instead int internally interplay interpret intrinsic introduce introduced introducing introduction investigate invisible invisibly invokes invoking involves is: is; isolated issues its itself just keyword keywords kind know know: knowing known l0; l1; labeled lack lamented language languages large last later latest lead leak leaks learned least leaving less let level levels lifetime lifetimes lifetimes: like likely limited lines linked list listing lists lists::two local locally locate locating location location: location; locations logic long longer look looking lose lot machinery main major make makes management manages manual manually map may means mechanism member members members: memory message messages messy metadata metadata: might missing mixed model model: moment more moreover most msvc msvc/x64 much multiple must mystery name namely naturally nature need needs nested nesting never nevertheless new new: new; next next; nice node non nor normally not note nothing notion now object objects objects: obligated obligations obscure obscuring observer obtain occur offset offsets often one ones only operating operator optimizations option ordinary other otherwise out outer output output: overall overlooked overwritten own pa
Tags Threat
Stories
Move


L'article ne semble pas avoir été repris aprés sa publication.


L'article ne semble pas avoir été repris sur un précédent.
My email: