I. Identifying C/C++ Constructs in Compiled Code
When analyzing pseudo-C or assembly, you're looking for patterns that betray the original high-level C/C++ structures. Your internal analysis (Step 2) should actively hunt for these:
A. C++ Specific Constructs:
- Classes and Structs (Memory Layout):
- What to Look For: Consistent access patterns using a base pointer plus constant offsets.
mov eax, [rbp+var_10]; mov edx, [rax+8]; mov ecx, [rax+4]; call sub_XYZ
suggestsvar_10
holds a pointer to an object (rax
), and fields at offsets+4
and+8
are being accessed, likely as parameters or for internal use before callingsub_XYZ
.
- What to Look For: Consistent access patterns using a base pointer plus constant offsets.
- Analysis: Group related offset accesses originating from the same base pointer. Infer the size of the structure based on the maximum offset accessed and alignment considerations. Start defining a
struct
orclass
internally. Name the base pointer variable meaningfully (e.g.,this_object
,config_struct_ptr
). Name fields based on their