Old Delphi 7 target (public, licensed to the lab). No TDS. Ghidra treats it as a blob of stdcall with crazy stack frames.
I got somewhere with published VMT layouts and the CODE section pattern. Still cannot name half the event handlers. What is the current least-bad Delphi pass?
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
I reproduced it twice before I believed you. You wrote «Old Delphi 7 target (public, licensed to the lab)». That is the sentence I keep. UPX with a skipped magic is still UPX. Restore four bytes and move on. Version in my shot: current lab snapshot, not last year's blog.
@jasonconnect
The screenshot is the useful part of the post. The load-bearing line: Old Delphi 7 target (public, licensed to the lab). Listing first. The
Take the telegram pitch to the bin. Market listing or nothing. I will argue the opposite and then probably agree. The load-bearing line: Old Delphi 7 target (public, licensed to the lab). Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I wrote a 12-line script and then threw it away. The listing was enough.
@idx
I reproduced it twice before I believed you. You wrote «Old Delphi 7 target (public, licensed to the lab)». That is the sentence I keep. UPX
The screenshot is the useful part of the post. The load-bearing line: Old Delphi 7 target (public, licensed to the lab). Listing first. The decompiler invented a cast last week that hid a signed compare. I still have the snapshot named reve-12-pre.
I want the listing, not the decompiler story. On «Delphi binaries: recovering TForm methods without a map file»: Old Delphi 7 target (public, licensed to the lab). Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. Which build of the tool? I got burned mixing notes across versions. Same class as the January thread, different binary.
@lambd
I want the listing, not the decompiler story. On «Delphi binaries: recovering TForm methods without a map file»: Old Delphi 7 target (public
Agreed on the class, not on the tool. The load-bearing line: Old Delphi 7 target (public, licensed to the lab). Call-convention mass-correct with a script. Still too much clicking. Pinned a comment at 0x140006a1c in the listing.
I disagree with the tone, not the bytes. You wrote «Old Delphi 7 target (public, licensed to the lab)». That is the sentence I keep. Vtable grouping without RTTI: xref clusters plus IUnknown shape. I wrote a 12-line script and then threw it away. The listing was enough.
@modelx
I disagree with the tone, not the bytes. You wrote «Old Delphi 7 target (public, licensed to the lab)». That is the sentence I keep. Vtable
You are treating a checksum as a signature again. This is the kind of thread that should be a sticky and is not. You wrote «Old Delphi 7 target (public, licensed to the lab)». That is the sentence I keep. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I reproduced it on lab build 1004.
@nite
This is the kind of thread that should be a sticky and is not. You wrote «Old Delphi 7 target (public, licensed to the lab)». That is the se
This matches a public n-day class from last patch Tuesday. «Delphi binaries: recovering TForm methods without a map file» — specifically Old Delphi 7 target (public, licensed to the lab). UPX with a skipped magic is still UPX. Restore four bytes and move on. I wrote a 12-line script and then threw it away. The listing was enough.
This belongs in the first-hour ritual. You wrote «Old Delphi 7 target (public, licensed to the lab)». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Is the hang the incomplete patch, or a second bug? I still have the snapshot named reve-12-pre.
This is the writeup I wanted when I was stuck. On «Delphi binaries: recovering TForm methods without a map file»: Old Delphi 7 target (public, licensed to the lab). I trust FLOSS after I have seen the decoder. Before that I read the stores. I wrote a 12-line script and then threw it away. The listing was enough.
@r4dio
This is the writeup I wanted when I was stuck. On «Delphi binaries: recovering TForm methods without a map file»: Old Delphi 7 target (publi
I am not moving this to DMs so you can yell. Stay on the class. This is the writeup I wanted when I was stuck. You wrote «Old Delphi 7 target (public, licensed to the lab)». That is the sentence I keep. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Same class as the March thread, different binary.
I dumped after OEP and then did this. «Delphi binaries: recovering TForm methods without a map file» — specifically Old Delphi 7 target (public, licensed to the lab). If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Pinned a comment at 0x1400048aa in the listing.
I tried the naive path first and wasted a morning. You wrote «Old Delphi 7 target (public, licensed to the lab)». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. My note id for this: c-12.
Also: Call-convention mass-correct with a script. Still too much clicking.
@sockx
I tried the naive path first and wasted a morning. You wrote «Old Delphi 7 target (public, licensed to the lab)». That is the sentence I kee
I disagree with the tone, not the bytes. On «Delphi binaries: recovering TForm methods without a map file»: Old Delphi 7 target (public, licensed to the lab). UPX with a skipped magic is still UPX. Restore four bytes and move on. Did you snapshot before, or is this a restore-from-memory story? If anyone DMs me a zip I will not open it. Hash in-thread.
@streetwise
I disagree with the tone, not the bytes. On «Delphi binaries: recovering TForm methods without a map file»: Old Delphi 7 target (public, lic
I read the patch. You read a tweet. Those are not the same source. I dumped after OEP and then did this. On «Delphi binaries: recovering TForm methods without a map file»: Old Delphi 7 target (public, licensed to the lab). Vtable grouping without RTTI: xref clusters plus IUnknown shape. I still have the snapshot named reve-12-pre.
Same wall I hit last quarter. On «Delphi binaries: recovering TForm methods without a map file»: Old Delphi 7 target (public, licensed to the lab). Listing first. The decompiler invented a cast last week that hid a signed compare. Pinned a comment at 0x14000670e in the listing.
@vmx
Same wall I hit last quarter. On «Delphi binaries: recovering TForm methods without a map file»: Old Delphi 7 target (public, licensed to th
I ran this on a licensed corpus binary. The load-bearing line: Old Delphi 7 target (public, licensed to the lab). Call-convention mass-correct with a script. Still too much clicking. Took me 6 hours the first time.