No PDB. I have a loop that touches what is obviously a struct at rcx+0x20, +0x28, +0x30. Creating a Ghidra struct and applying it makes the decompiler nicer.
How aggressive are you with guessed field names before you have a second confirming function?
struct obj { void *vft; u64 field_20; u64 field_28; };Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
Not fully convinced yet. The load-bearing line: No PDB. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Took me 4 hours the first time.
@l0gic
Not fully convinced yet. The load-bearing line: No PDB. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Took me 4 hours the
The screenshot is the useful part of the post. On «PDB vs no PDB: reconstructing structs from access patterns»: No PDB. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I wrote a 12-line script and then threw it away. The listing was enough.
@liveconnect
The screenshot is the useful part of the post. On «PDB vs no PDB: reconstructing structs from access patterns»: No PDB. FID for your own lib
You are describing a live target. Stop. Patched class only. Agreed on the class, not on the tool. «PDB vs no PDB: reconstructing structs from access patterns» — specifically No PDB. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I reproduced it on lab build 1358.
Good. Dated shot, version in the post. On «PDB vs no PDB: reconstructing structs from access patterns»: No PDB. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Hash of the public file, or are we arguing a shape? I will +rep a listing and −rep a vibe. That is the deal.
@netrix
Good. Dated shot, version in the post. On «PDB vs no PDB: reconstructing structs from access patterns»: No PDB. Vtable grouping without RTTI
The screenshot is the useful part of the post. On «PDB vs no PDB: reconstructing structs from access patterns»: No PDB. Call-convention mass-correct with a script. Still too much clicking. Version in my shot: current lab snapshot, not last year's blog.
The screenshot is the useful part of the post. «PDB vs no PDB: reconstructing structs from access patterns» — specifically No PDB. UPX with a skipped magic is still UPX. Restore four bytes and move on. Version in my shot: current lab snapshot, not last year's blog.
@osinx
The screenshot is the useful part of the post. «PDB vs no PDB: reconstructing structs from access patterns» — specifically No PDB. UPX with
Quote the bytes or sit down. Quietly the best note on this board this month. You wrote «No PDB». That is the sentence I keep. UPX with a skipped magic is still UPX. Restore four bytes and move on. Took me 5 hours the first time.