Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add RTTI-Support #1

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add RTTI-Support #1

wants to merge 1 commit into from

Conversation

Garey27
Copy link

@Garey27 Garey27 commented Nov 13, 2019

Hello, thank you for that awesome script.

I've think its possible to rename RTTI class member functions according to linux one if there same vtable size.

Also i fixed _get_xref_to_calls function:

            func = get_func(xref.frm)
            if (func is None):
                yield xref.to
            else:
                yield func.startEA

I think there was problem xref.to was always same as ea thats why _multiple_xrefs_search was not worked as excepted.

Also maybe rtti renamer function should be rewritted, but im not good at python atm :-)

Here's some results with current implementation on some client dll+so from Half-Life 1:

  1. Found 670 (14.7%) functions in total! - no rtti rename
  2. Found 1402 (30.8%) functions in total! - rtti vtable size match rename
  3. Found 2452 (53.8%) functions in total! - rtti + dirty incorrect vtable size match rename

3 Is looks good but since vtables size mismatch i think in this case we can add some symbol before function like !!CBaseMonster::TraceAttack to indicate that function mb incorrect

RTTI scripts are from: https://github.com/nccgroup/SusanRTTI with little modification to scan vtable functions addresses

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant