View unanswered posts | View active topics It is currently May 19th, '13, 08:34




Reply to topic  [ 14 posts ]  Go to page 1, 2  Next
 Class Informer 1.06 
Author Message
Site Moderator
User avatar

Joined: Aug 18th, '09, 03:32
Posts: 1201
Post Class Informer 1.06
Class Informer
=============================================================================
IDA Pro Win32 class vftable finder, namer, fixer, viewer plug-in.

Scans an MSVC 32bit target IDB for vftables with C++ RTTI, and MFC RTCI type data.
Places structure defs, names, labels, and comments to make more sense of class vftables ("Virtual Function Table").
Creates a handy list window with found vftables for browsing.

Puts more context on class/structure related things to aid in reverse engineering.

RTTI ("Run-Time Type Identification")
RTCI ("Run Time Class Information") the MFC forerunner to RTTI

Based off of the article and materials by Igor Skochinsky:
Reversing Microsoft Visual C++ Part II: Classes, Methods and RTTI


The plug-in dialog:
Image

Example vftable info set by plug-in:
Image

Example vftable output list:
Image

In this executable that was largely C++ with RTTI, this plug-in added a lot of contextual class data.
Plus in this case added a good amount of clean-up as the result of properly identifying and placing various RTTI data structures.
Typically when IDA sees previously unknown data now defined it will automatically reanalyze associated areas that can result in yet more data references and previously unknown functions being found. Removes more of the "unknown".

Version 1.06
Quote:
1.06 - 1) Added persistent vftable list storage.
2) Removed the many unnecessary "autoWait()" calls that caused a bit of a slow down.
3) Fixed broken and updated some custom UI elements.
4) Fixed the multi-segment select feature for the non-QT version and
added a working setup for the QT version too. For QT, after desired
segments are selected right click on the list and do "Select"
followed by the "Okay" button.
5) Added the ".data" segment to the default data search since vftables
are often located there (in addition to ".rdata").

1.05 - 1) The problem with the plug-in not being ready on invocation was fixed
by returning PLUGIN_KEEP on init to stay resident.
2) The fix in 1.04 didn't quite do it for structure placement problems.
In particular there remains a run on problem in IDA when marking some
areas "unknown"; these "do_unknown()" calls have been removed and
each structure element is individually placed one by one before
attempting to place the actual assorted structures.

1.04 - 1) Now ensures RTTI type name strings are set.

1.03 - 1) Added check and warning message for invalid start and end addresses
with "_initterm" type static/global ctor & dtor tables.
Would cause a negative count run-on condition that could trample over
a large data area.
2) UI customizations auto-disabled when using IDA Qt version.
3) Current IDA view is refreshed on completion to show changes.
4) Fixed a stall that could result from repeated failed attempts at an
RTTI type placement. Plus fixed the pattern for these so they could
be properly placed.

1.02 - 1) Added user code and data segment selector.
Allows user to select multiple data and code segments instead of the
default of ".text" and ".rdata" by name.
For those rare executable targets that have multiple code sections,
and, or, unpacked executables with mixed segments, etc.
2) Added config option for verbose output to the debugger channel.
3) Improved overall processing speed.
4) Since there can multiple instances of the same class or structure,
and IDA names must be unique all duplicate names are now serialized.
More things labeled, and no more "duplicate name" warning spam.
Note: Effects only label names, commented names are not altered
5) Updated to IDA SDK 5.5
6) Added links to Sirmabus IDA plug-ins support forum.

1.01 - 1) No longer pops up an error and exits IDA when an incompatible IDB is
loaded. Just displays a "not loaded" log message now.
2) Fixed IDA tab page update issue.
3) Now built with IDA SDK 5.4, and tested with IDA 5.4.
4) Fixed incorrect string placement in the RTTI type info struct.
Now the structures are right which make a cleaner DB.
This was a major bottleneck that caused the structure placement to be
about 36x slower, now only about 1x.
5) Fixed some misspellings.


Source: http://sourceforge.net/projects/classinformer/

IDA_ClassInformer_PlugIn.plw - MD5: 14D971F2A1E3E652F4A4CA19FEE2B7B0

>>> Download <<


Mar 28th, '11, 01:16
Profile

Joined: Oct 10th, '11, 17:29
Posts: 3
Post Re: Class Informer
Sirmabus wrote:
You’ll just have to run the plug-in again. It shouldn’t be a problem because for example it will skip existing comments, etc.


So if I have to run it again it shouldn't take 5+ hours to run? If so should I uncheck certain options since it has been run once already?

Thanks,
Iceazuk


Oct 10th, '11, 17:35
Profile
Site Moderator
User avatar

Joined: Aug 18th, '09, 03:32
Posts: 1201
Post Re: Class Informer
Iceazuk wrote:
Sirmabus wrote:
You’ll just have to run the plug-in again. It shouldn’t be a problem because for example it will skip existing comments, etc.


So if I have to run it again it shouldn't take 5+ hours to run? If so should I uncheck certain options since it has been run once already?

Thanks,
Iceazuk

To fill the reader in, you sent me the large target EXE you were having trouble with.
It has a unusual large sized 4mb .rdata section with 5157 RTTI types and a total of 5495 vftables.
Not surprising since that particular developer likes to abstract and OOP everything ad nauseum.
The size/count is not the problem anyhow, just exacerbates it.

It turns out IDA makes a particular pattern with this EXE where it adds a junk/incorrect data just before some type RTTI type defs.
This hit some rare part of the plug-in that hasn't really been tested before that turns out wasn't even needed anyhow.
I fixed this, plus made it so that junk gets cleared so types can be placed there.

In design maybe the plug-in should have some sort of persistent storage were you'd only have to run it once and then reload to get the class list GUI.
But then this will take me some R&D to see if I can store stuff as IDB data "nodes" et al.

Now took me about 30 seconds total to run it with the new version.
Get the 1.03 by using the same "Download button" above.


Oct 11th, '11, 11:04
Profile

Joined: Oct 10th, '11, 17:29
Posts: 3
Post Re: Class Informer
I think I am doing something wrong since when I try to click the option to choose code and data segments it brings up a menu with the segments but I am unable to click anything at all and the program locks up. Since it won't let me click anything I can't exit the menu or the program. In task manager it doesn't show it as not responding so not sure why it's locked up.

Thanks for the help and I hope I am doing somthing wrong.
Iceazuk


Oct 11th, '11, 15:32
Profile
Site Moderator
User avatar

Joined: Aug 18th, '09, 03:32
Posts: 1201
Post Re: Class Informer
Are you using the Qt 6.x version of IDA?
My custom multi-segment select dialog won't work with that version.
Qt is all owner draw windows thus they can't be easily sub-classed/controlled.
It shouldn't crash though.

Try using the "idag.exe" version, not "idaq.exe" (with a 'Q').

Then you should be able to select multiple segments using left click plus CTRL or SHIFT key like you do with regular Windows list boxes, etc.
Maybe you don't need to custom select them.
If there is a single ".text" code segment, a single ".rdata" section, etc.


Oct 11th, '11, 20:46
Profile

Joined: Oct 10th, '11, 17:29
Posts: 3
Post Re: Class Informer
I am not exactly sure what Qt is so it's safe to assume I am not using it. My guess about QT is it's related to or a plugin for the python plugin. I do have the python plugin installed but nothing else for it.

I will check out idag to see if it solves the problem. I will let you know the out come.

Thank you for your time and help,
Iceazuk

I was using the idag when I was getting that problem oddly though when I tested idaq it worked just fine still took forever for the plugin to run but its ok.


Oct 13th, '11, 20:24
Profile
Site Moderator
User avatar

Joined: Aug 18th, '09, 03:32
Posts: 1201
Post Re: Class Informer 1.04
Updated with version 1.04:
Quote:
1.04 - 1) Now ensures RTTI type name strings are set.

A good fix because a lot of times the RTTI type strings weren't getting set due to their variable lengths.
Most if not all of those ".?AU...." run of bytes should be strings (mangled type names) now, making the type defs complete and making your IDB more whole.
Dawned on me after some times obsessively fixing these by hand, that in addition to setting the types structure ("doStruct()" API call), the names had to be implicitly set (with a "doASCI()" API call).
Unfortunately these won't be fixed in your IDB if ran the old version of Class Informer previously on it.


Oct 23rd, '11, 17:22
Profile

Joined: Jun 11th, '12, 03:33
Posts: 1
Post Re: Class Informer 1.04
i go to edit -> plugins but there is no option to add the plugin?
i am using ida pro verison 6.1.0.110409 (32 bit)


Jun 11th, '12, 03:38
Profile
Site Moderator
User avatar

Joined: Aug 18th, '09, 03:32
Posts: 1201
Post Re: Class Informer 1.04
Anddos wrote:
i go to edit -> plugins but there is no option to add the plugin?
i am using ida pro verison 6.1.0.110409 (32 bit)

In "Class_Informer.txt" there is a section "[Install]" that tells you how to install it.
There's no automated installer although it's pretty easy.
It would be nice if there was some kind of "plug-in manager" maybe, but no such thing comes with IDA yet.

You'll have to do it manually:
Quote:
Copy the plug-in to your IDA Pro "plugins" directory.
Then edit your "..\plugins\plugins.cfg" to setup with a hotkey.

IE: Add these two lines:

; Sirmabus "Class Informer" plug-in
Class-Informer IDA_ClassInformer_PlugIn.plw Alt-7 0

Once you copy the plug-in over and edit your "plugins.cfg", then restart IDA it will show up in the Edit->Plugins list.

If you need more general help go to the IDA forum: http://www.hex-rays.com/forum/index.php
And, or: Google search "How to install IDA Pro plugins"


Jun 12th, '12, 22:27
Profile
User avatar

Joined: Sep 26th, '12, 23:21
Posts: 2
Post Re: Class Informer 1.04
First, thanks for your plug-in. I'm using it quite often.

Is there any chance that the plug-in doesn't override the RTTI/RTCI structures if they are already present in the database?

Background: In early MFC versions there is no m_pClassInit member in the CRuntimeClass structure (named RTCI in your plug-in) and m_pfnGetBaseClass/m_pBaseClass depends on _AFXDLL. See the attachment in the following thread on the Hey-Rays forum: sizeof=0 variable size structures (RTTIBaseClassArray)


Sep 26th, '12, 23:37
Profile
Display posts from previous:  Sort by  
Reply to topic   [ 14 posts ]  Go to page 1, 2  Next

Who is online

Users browsing this forum: No registered users and 0 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group.
Based on design by STSoftware, modded by Sirmabus Copyright© 2009-2011