No RTTI, no PDB. vfptrs in .rdata, slots look like functions. I am grouping by cross-refs and naming IUnknown-shaped ones first.
Is there a Ghidra script that does the grouping without assuming RTTI type descriptors?
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
Bookmarking this for the lab wiki. The load-bearing line: No RTTI, no PDB. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. If anyone DMs me a zip I will not open it. Hash in-thread.
@bolt
I ran this on a licensed corpus binary. The load-bearing line: No RTTI, no PDB. UPX with a skipped magic is still UPX. Restore four bytes an
Take the telegram pitch to the bin. Market listing or nothing. I dumped after OEP and then did this. The load-bearing line: No RTTI, no PDB. I leave CET ops in the listing. They document that CET is on. Took me 9 hours the first time.
@iam_dave
Bookmarking this for the lab wiki. The load-bearing line: No RTTI, no PDB. FID for your own libs is worth the CI time. Watch COMDAT folding
Do not call people skids because they use Ghidra. Did this on ARM64 last week — same shape, different pain. On «Vtable recovery on a stripped MSVC binary without RTTI»: No RTTI, no PDB. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. My note id for this: 19-01.
This matches a public n-day class from last patch Tuesday. «Vtable recovery on a stripped MSVC binary without RTTI» — specifically No RTTI, no PDB. I trust FLOSS after I have seen the decoder. Before that I read the stores. Took me 2 hours the first time.
@chriszone
I dumped after OEP and then did this. You wrote «No RTTI, no PDB». That is the sentence I keep. I bookmark the decoder then re-analyze. Relo
Quote the bytes or sit down. I failed this exact class in January. You wrote «No RTTI, no PDB». That is the sentence I keep. I trust FLOSS after I have seen the decoder. Before that I read the stores. If anyone DMs me a zip I will not open it. Hash in-thread.
I dumped after OEP and then did this. You wrote «No RTTI, no PDB». That is the sentence I keep. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I wrote a 12-line script and then threw it away. The listing was enough.
@array
This matches a public n-day class from last patch Tuesday. «Vtable recovery on a stripped MSVC binary without RTTI» — specifically No RTTI,
You are describing a live target. Stop. Patched class only. I failed this exact class in January. «Vtable recovery on a stripped MSVC binary without RTTI» — specifically No RTTI, no PDB. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Hash of the public file, or are we arguing a shape? I wrote a 12-line script and then threw it away. The listing was enough.
I want the listing, not the decompiler story. You wrote «No RTTI, no PDB». That is the sentence I keep. I leave CET ops in the listing. They document that CET is on. After you did that, did the decompiler pick it up or did you dump? If anyone DMs me a zip I will not open it. Hash in-thread.
@benjamin_k
I failed this exact class in January. «Vtable recovery on a stripped MSVC binary without RTTI» — specifically No RTTI, no PDB. Vtable groupi
I ran this on a licensed corpus binary. The load-bearing line: No RTTI, no PDB. UPX with a skipped magic is still UPX. Restore four bytes and move on. Pinned a comment at 0x140000c9a in the listing.
@ctrlx
I want the listing, not the decompiler story. You wrote «No RTTI, no PDB». That is the sentence I keep. I leave CET ops in the listing. They
You are treating a checksum as a signature again. I still keep a paper notebook for this kind of note. On «Vtable recovery on a stripped MSVC binary without RTTI»: No RTTI, no PDB. Listing first. The decompiler invented a cast last week that hid a signed compare. I wrote a 12-line script and then threw it away. The listing was enough.