Reverse Engineer a C++ implementation

If you were given a large and complex multi-threaded C++ implementation and asked to come up with a detailed design document for the same, I would like to know how you would go about doing this.

I am in a somewhat similar situation and am not allowed to use any external tools other than Microsoft Visual Studio 2008. I am thinking of a strategy to start and finish with.
Who is Participating?
JimBeveridgeConnect With a Mentor Commented:
The strategy is that you find the "core" of the system to start with, then start moving outward. You can expect to find something like:

- Init app
- Run main loop (gui) or dispatcher (service)
- Shutdown

Start by documenting these pieces to get your baseline, then research more of the system, piece by piece, and document what you find for each piece.

In a heavily-multithreaded app, the dispatcher is generally handled by Windows in the form of an I/O completion port managing a thread pool.

Now you want to find everything that raises an event (hands something to the dispatcher) and then everything that processes an event (is called by the dispatcher.) Document each of these in turn.

The entire point is to break up your research into manageable chunks that can be researched individually. If you try to attack the entire thing as a whole, you'll drown in data.
HawyLemConnect With a Mentor Commented:
That's just what you need.

heavy multithreaded is not synonymous with "Undebuggable", you can breakpoint into the thread's routines and if you have doubts about who called that, look at the call stack window VS provides you.

Having source code, symbols and VS makes your debugging very easy. You just need a lot of patience
I assume you do not have the source code? Unless you want to learn assembler, the only way to do reverse engineering is to observe and test test test.

Play with the application and see what it does, then make testable assumptions about the design. Then test them.

By "no external tools" does that mean you can't use programs similar to task manager to see the processes and threads that spawn?
Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Wait.. no source code makes VS not the best tool. I would suggest OllyDbg or IDA pro.

But watch out for legal issues, you may have not the permission to disassemble the code.

If the application belongs to your society and you have the right to disasm it, then open it up with a debugger and use breakpoints (software or hardware) to step in the right function. Threads should not be a problem since debuggers let you break in every routine you need.
sukhoi35Author Commented:
Hello Experts,
Thanks for your responses. I am sorry if the details I provided does not clear whether the source code is avaialbe or not with me. Yes, I do have the full source code which is in C++. My only worry is it is a complex architecture. So, was wondering should I just start at the entry point and walk-through the code method by method or is there any other better approach to the task.

TommySzalapskiConnect With a Mentor Commented:
My suggestion would be to find the places where new threads spawn and put breakpoints there (after) so that you can catch both. Otherwise new threads will run in the background and you won't have control.
Stepping line by line is good if it works. Often it takes many lines to get to where you need to be so it might take a very long time. If you are running the code in VS (in debug mode) you can hit the 'break' button on the keyboard at any time and it will stop and you can do line-by-line from there. (might be ctrl+break).
sarabandeConnect With a Mentor Commented:
if it is console application (has function main or tmain) i would go topdown from that inspecting any class type used and function called.

for a gui app based on a framework like mfc or qt you firstly should get familiar with that framework before examining specialization.

you could use tools like doxygen which would give good overview charts of what is going on.

Deepu AbrahamR & D Engineering ManagerCommented:

If logging mechanism is not there then I would suggest you to add some log messages (which writes to a file and print the thread id also inside - to know which thread called which function) in each and every functions. This might be time consuming but it will get you understand the code/functionality very fast. My 2 cents :)

sukhoi35Author Commented:
Thank You Very Much!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.