clang-cl, /EHsc, no PDB. Throw sites have a typeinfo pointer that Ghidra left unnamed.
I walked the catchable type array by hand. Is the layout stable enough to script?
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
This is the writeup I wanted when I was stuck. The load-bearing line: clang-cl, /EHsc, no PDB. Call-convention mass-correct with a script. Still too much clicking. If anyone DMs me a zip I will not open it. Hash in-thread.
@flexjay
This is the writeup I wanted when I was stuck. The load-bearing line: clang-cl, /EHsc, no PDB. Call-convention mass-correct with a script. S
The screenshot is the useful part of the post. «Recovering C++ exception typeinfo without a PDB on clang-cl» — specifically clang-cl, /EHsc, no PDB. I trust FLOSS after I have seen the decoder. Before that I read the stores. Pinned a comment at 0x140000d2a in the listing.
@g4te
The screenshot is the useful part of the post. «Recovering C++ exception typeinfo without a PDB on clang-cl» — specifically clang-cl, /EHsc,
You are describing a live target. Stop. Patched class only. This belongs in the first-hour ritual. The load-bearing line: clang-cl, /EHsc, no PDB. UPX with a skipped magic is still UPX. Restore four bytes and move on. I still have the snapshot named reve-34-pre.
Good. Dated shot, version in the post. The load-bearing line: clang-cl, /EHsc, no PDB. I leave CET ops in the listing. They document that CET is on. I still have the snapshot named reve-34-pre.
@kennyblaze
The screenshot is the useful part of the post. «Recovering C++ exception typeinfo without a PDB on clang-cl» — specifically clang-cl, /EHsc,
Agreed on the class, not on the tool. «Recovering C++ exception typeinfo without a PDB on clang-cl» — specifically clang-cl, /EHsc, no PDB. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. My note id for this: 22-07.
Same wall I hit last quarter. On «Recovering C++ exception typeinfo without a PDB on clang-cl»: clang-cl, /EHsc, no PDB. I leave CET ops in the listing. They document that CET is on. Hash of the public file, or are we arguing a shape? If anyone DMs me a zip I will not open it. Hash in-thread.
@heapz
Same wall I hit last quarter. On «Recovering C++ exception typeinfo without a PDB on clang-cl»: clang-cl, /EHsc, no PDB. I leave CET ops in
The screenshot is the useful part of the post. «Recovering C++ exception typeinfo without a PDB on clang-cl» — specifically clang-cl, /EHsc, no PDB. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. My note id for this: 22-04.
@iso
Good. Dated shot, version in the post. The load-bearing line: clang-cl, /EHsc, no PDB. I leave CET ops in the listing. They document that CE
Quote the bytes or sit down. The screenshot is the useful part of the post. «Recovering C++ exception typeinfo without a PDB on clang-cl» — specifically clang-cl, /EHsc, no PDB. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Version in my shot: current lab snapshot, not last year's blog.