Improve vtable detection for C++, ObjectiveC, Dlang and Swift binaries

[XVilka]

• [ ] C++ structures parsing for VC++ generated binaries https://github.com/REhints/HexRaysCodeXplorer & http://www.openrce.org/articles/full_view/23
• [ ] C++ structures parsing for OS X clang C++ generated binaries https://github.com/cocoahuke/maclook4ref
• [ ] C++ structures parsing for *nix GCC C++ generated binaries
• [ ] COM classes parsing for Windows binaries https://github.com/nektra/vtbl-ida-pro-plugin + http://blog.nektra.com/main/2013/03/27/how-to-identify-virtual-table-functions-with-the-vtbl-ida-pro-plugin/

What should be done (in C, as part of Rizin):

• [ ] Connecting classes with their methods
• [ ] Class inheritance - nesting data structs
• [ ] Constructors and destructors autorecognition
• [ ] try/catch/finally recognition and marking
• [ ] arguments recognition
• [ ] ASCII/graphviz graph of class inheritance/structure inheritance
• [ ] Tests with sources for C++, FreePascal, D language, ObjC and Swift, for rizin-testbins

See the relevant code at

• librz/analysis/class.c
• librz/analysis/vtable.c
• librz/analysis/rtti.c
• libr/analysis/rtti_msvc.c
• libr/analysis/rtti_itanium.c

Examples of similar features in another programs:

• https://github.com/REhints/HexRaysCodeXplorer
• https://github.com/astrelsky/Ghidra-Cpp-Class-Analyzer
• https://github.com/trailofbits/binjascripts/tree/master/vtable-navigator
• https://github.com/igogo-x86/HexRaysPyTools
• https://github.com/nccgroup/PythonClassInformer
• https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/october/python-class-informer-an-idapython-plugin-for-viewing-run-time-type-information-rtti/
• https://github.com/avast-tl/retdec/tree/master/src/bin2llvmir/optimizations/vtable
• https://github.com/bazad/memctl
• https://github.com/cocoahuke/maclook4ref
• https://github.com/RUB-SysSec/Marx
• https://github.com/whitequark/binja_itanium_cxx_abi
• https://alschwalm.com/blog/static/2016/12/17/reversing-c-virtual-functions/
• https://alschwalm.com/blog/static/2017/01/24/reversing-c-virtual-functions-part-2-2/
• http://blog.httrack.com/blog/2014/05/09/a-basic-glance-at-the-virtual-table/
• https://github.com/0xgalz/Virtuailor
• https://github.com/cmu-sei/pharos

More information about the same for Swift binaries:

• https://mikeash.com/pyblog/friday-qa-2014-07-18-exploring-swift-memory-layout.html
• https://www.raizlabs.com/dev/2016/12/swift-method-dispatch/

More information about the same for Objective C binaries:

• http://cocoasamurai.blogspot.com/2010/01/understanding-objective-c-runtime.html

More information about the same in FreePascal binaries:

• https://wiki.freepascal.org/Interface_delegation

More information about the same in D language binaries:

• https://p0nce.github.io/d-idioms/#Inside-the-D-Object-Model

See also these for extracting C++ classes information from kernelcache:

• https://github.com/0x36/ghidra_kernelcache
• https://github.com/bazad/ida_kernelcache

[fangxlmr]

@Basstorm This issue is asigned to you as RSoC micro-task, so you could work on this from now on. Feel free to ask questions and send Pull Requests.

In case for anyone who is not aware about RSoC.

CC @XVilka

[XVilka]

@Basstorm please note, that this is "meta" issue, so any improvement in vtable detection in one of the aforementioned categories counts.

[Basstorm]

@XVilka @fangxlmr Okay, I'll do my best, thanks.

[Basstorm]

Can I using rz_bin_get_classes function in class.c directly to get the classes and their members, and do the next job like constructor autorecognition? @XVilka

[XVilka]

@Basstorm I think you got your answer on the Mattermost. Let me know if there is something unclear yet.

[Basstorm]

811

819

852

d-lang PR