binaryninja-api icon indicating copy to clipboard operation
binaryninja-api copied to clipboard

MSVC RTTI analysis

Open op2786 opened this issue 2 years ago • 4 comments

There is a plugin for it named MSVC that hasn't been updated since 2019. I believe this feature should be in the core.

op2786 avatar Feb 23 '23 07:02 op2786

I have created a plugin recently that symbolizes and parses msvc rtti information, it can be found here: https://github.com/emesare/binja-msvc. It is missing quite a few QoL features like a UI however the parsing and symbolizing is pretty much finished.

If msvc rtti analysis were to be included in the core I figure that some compromises would need to be made in terms of how "ownership" of a virtual function is dealt with, specifically when it comes to shared virtual functions.

edit: Also I had to use llvm's demangler instead of builtin ms_demangler due to builtin demangler failing to demangle, I think this is the relevant issue: #1653

emesare avatar Apr 15 '23 01:04 emesare

There is a preliminary branch with MSVC RTTI analysis in the PE view. However it will cause the debug info (PDB's) to reference bare virtual function tables (if loader.pe.processRttiVtables is enabled), this is of course, undesirable. We really need workflows (specifically module level workflows) to solve this gracefully. Otherwise reanalysis will need to be triggered (this is a side effect of the debug info) which for larger binaries is not an option.

https://github.com/Vector35/binaryninja-api/tree/test_pe_rtti

emesare avatar Jul 25 '24 21:07 emesare

Another solution would be to avoid naming types the same as the PDB, however this will lead to a lot of duplicate types which a user might confusingly choose over the more accurate and rich PDB types. We could also modify the PDB plugin to actually wipe the type, I think this would require only minimal changes however it could be that that behavior is relied on internally.

emesare avatar Jul 26 '24 11:07 emesare

The current working MSVC RTTI analysis is being done as apart of https://github.com/emesare/binja-msvc/tree/test-2.0, this could be moved into the core, or kept as a separate plugin, pending further discussion.

emesare avatar Oct 10 '24 17:10 emesare

Added in https://github.com/Vector35/binaryninja-api/commit/93e0a64e77169c29960a1cbd9bdedadfeb4a5f7e and available on Binary Ninja with >=6285.

Some sample scripts for consuming RTTI information can be found here.

emesare avatar Oct 24 '24 15:10 emesare