Star 0

Abstract

The report will present the plugin for Hex-Rays Decompiler. The plugin is an attempt to resolve the issue of reconstruction and understand how complex structures work. It helps to analyse large amounts of code automatically, collect information about field reference names and visit places where the reference occurs. After structure finalization, its type is used anywhere the scan have reached. It also detects virtual tables, collects all classes in a separate menu and helps to rename and change the signature of virtual functions.
Moreover it helps to work with negative offsets, selecting a list of appropriate large structures and inserting CONTAINING_RECORD macro in listing. It builds a graph of the relationship between types of LocalTypes and has several opportunities for quick modification of a disassembly listing.

Slides