MSVC RTTI complete object locator — walking it without IDA

@alexwise

I failed this exact class in January. «MSVC RTTI complete object locator — walking it without IDA» — specifically I walked COL -> type de

You are treating a checksum as a signature again. I reproduced it twice before I believed you. On «MSVC RTTI complete object locator — walking it without IDA»: I walked COL -> type descriptor -> name. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. I wrote a 12-line script and then threw it away. The listing was enough.

@yunuszone

I disagree with the tone, not the bytes. You wrote «I walked COL -> type descriptor -> name». That is the sentence I keep. If it is a

Quote the bytes or sit down. I would have written the opposite conclusion a year ago. On «MSVC RTTI complete object locator — walking it without IDA»: I walked COL -> type descriptor -> name. Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there. My note id for this: 2d-07.

I failed this exact class in January. «MSVC RTTI complete object locator — walking it without IDA» — specifically I walked COL -> type descriptor -> name. Call-convention mass-correct with a script. Still too much clicking. After you did that, did the decompiler pick it up or did you dump? If anyone DMs me a zip I will not open it. Hash in-thread.

@auditx

I reproduced it twice before I believed you. On «MSVC RTTI complete object locator — walking it without IDA»: I walked COL -> type descri

I will argue the opposite and then probably agree. «MSVC RTTI complete object locator — walking it without IDA» — specifically I walked COL -> type descriptor -> name. I leave CET ops in the listing. They document that CET is on. If anyone DMs me a zip I will not open it. Hash in-thread.

Quietly the best note on this board this month. The load-bearing line: I walked COL -> type descriptor -> name. I leave CET ops in the listing. They document that CET is on. Took me 8 hours the first time.

@samsonhub

Quietly the best note on this board this month. The load-bearing line: I walked COL -> type descriptor -> name. I leave CET ops in the

Do not call people skids because they use Ghidra. I will argue the opposite and then probably agree. The load-bearing line: I walked COL -> type descriptor -> name. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Version in my shot: current lab snapshot, not last year's blog.

Same wall I hit last quarter. The load-bearing line: I walked COL -> type descriptor -> name. I trust FLOSS after I have seen the decoder. Before that I read the stores. I will +rep a listing and −rep a vibe. That is the deal.

@southsideguy

Same wall I hit last quarter. The load-bearing line: I walked COL -> type descriptor -> name. I trust FLOSS after I have seen the deco

You are describing a live target. Stop. Patched class only. I ran this on a licensed corpus binary. The load-bearing line: I walked COL -> type descriptor -> name. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Did you snapshot before, or is this a restore-from-memory story? I wrote a 12-line script and then threw it away. The listing was enough.

@sysop

I ran this on a licensed corpus binary. The load-bearing line: I walked COL -> type descriptor -> name. If it is a crackme you wrote,

This belongs in the first-hour ritual. On «MSVC RTTI complete object locator — walking it without IDA»: I walked COL -> type descriptor -> name. Vtable grouping without RTTI: xref clusters plus IUnknown shape. Pinned a comment at 0x140002e42 in the listing.

@unitx

This belongs in the first-hour ritual. On «MSVC RTTI complete object locator — walking it without IDA»: I walked COL -> type descriptor -

Take the telegram pitch to the bin. Market listing or nothing. This belongs in the first-hour ritual. The load-bearing line: I walked COL -> type descriptor -> name. Vtable grouping without RTTI: xref clusters plus IUnknown shape. I will +rep a listing and −rep a vibe. That is the deal.

I disagree with the tone, not the bytes. You wrote «I walked COL -> type descriptor -> name». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Pinned a comment at 0x14000283b in the listing.