Solved

Reverse Engineer a C++ implementation

Posted on 2011-02-20
9
397 Views
Last Modified: 2012-05-11
If you were given a large and complex multi-threaded C++ implementation and asked to come up with a detailed design document for the same, I would like to know how you would go about doing this.

I am in a somewhat similar situation and am not allowed to use any external tools other than Microsoft Visual Studio 2008. I am thinking of a strategy to start and finish with.
0
Comment
Question by:sukhoi35
  • 2
  • 2
  • 2
  • +3
9 Comments
 
LVL 4

Assisted Solution

by:HawyLem
HawyLem earned 50 total points
Comment Utility
That's just what you need.

heavy multithreaded is not synonymous with "Undebuggable", you can breakpoint into the thread's routines and if you have doubts about who called that, look at the call stack window VS provides you.

Having source code, symbols and VS makes your debugging very easy. You just need a lot of patience
0
 
LVL 37

Expert Comment

by:TommySzalapski
Comment Utility
I assume you do not have the source code? Unless you want to learn assembler, the only way to do reverse engineering is to observe and test test test.

Play with the application and see what it does, then make testable assumptions about the design. Then test them.

By "no external tools" does that mean you can't use programs similar to task manager to see the processes and threads that spawn?
0
 
LVL 4

Expert Comment

by:HawyLem
Comment Utility
Wait.. no source code makes VS not the best tool. I would suggest OllyDbg or IDA pro.

But watch out for legal issues, you may have not the permission to disassemble the code.

If the application belongs to your society and you have the right to disasm it, then open it up with a debugger and use breakpoints (software or hardware) to step in the right function. Threads should not be a problem since debuggers let you break in every routine you need.
0
 

Author Comment

by:sukhoi35
Comment Utility
Hello Experts,
Thanks for your responses. I am sorry if the details I provided does not clear whether the source code is avaialbe or not with me. Yes, I do have the full source code which is in C++. My only worry is it is a complex architecture. So, was wondering should I just start at the entry point and walk-through the code method by method or is there any other better approach to the task.

Regards.
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 37

Assisted Solution

by:TommySzalapski
TommySzalapski earned 100 total points
Comment Utility
My suggestion would be to find the places where new threads spawn and put breakpoints there (after) so that you can catch both. Otherwise new threads will run in the background and you won't have control.
Stepping line by line is good if it works. Often it takes many lines to get to where you need to be so it might take a very long time. If you are running the code in VS (in debug mode) you can hit the 'break' button on the keyboard at any time and it will stop and you can do line-by-line from there. (might be ctrl+break).
0
 
LVL 32

Assisted Solution

by:sarabande
sarabande earned 50 total points
Comment Utility
if it is console application (has function main or tmain) i would go topdown from that inspecting any class type used and function called.

for a gui app based on a framework like mfc or qt you firstly should get familiar with that framework before examining specialization.


you could use tools like doxygen which would give good overview charts of what is going on.

Sara
0
 
LVL 7

Accepted Solution

by:
JimBeveridge earned 300 total points
Comment Utility
The strategy is that you find the "core" of the system to start with, then start moving outward. You can expect to find something like:

- Init app
- Run main loop (gui) or dispatcher (service)
- Shutdown

Start by documenting these pieces to get your baseline, then research more of the system, piece by piece, and document what you find for each piece.

In a heavily-multithreaded app, the dispatcher is generally handled by Windows in the form of an I/O completion port managing a thread pool.

Now you want to find everything that raises an event (hands something to the dispatcher) and then everything that processes an event (is called by the dispatcher.) Document each of these in turn.

The entire point is to break up your research into manageable chunks that can be researched individually. If you try to attack the entire thing as a whole, you'll drown in data.
0
 
LVL 11

Expert Comment

by:DeepuAbrahamK
Comment Utility

If logging mechanism is not there then I would suggest you to add some log messages (which writes to a file and print the thread id also inside - to know which thread called which function) in each and every functions. This might be time consuming but it will get you understand the code/functionality very fast. My 2 cents :)


0
 

Author Closing Comment

by:sukhoi35
Comment Utility
Thank You Very Much!
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

One of the most frequent problems a "newbie" developer may encounter is having to deal with different data formats. One for all: THE DATE We, as humans, need to "see" a date and then interpret it (much of the times this is an automatic operation)…
Before You Read The Article Please make sure you understand these two concepts: Variable Scope (http://www.php.net/manual/en/language.variables.scope.php) and Property Visibility (http://www.php.net/manual/en/language.oop5.visibility.php).  And to …
This tutorial covers a step-by-step guide to install VisualVM launcher in eclipse.
The goal of the tutorial is to teach the user how to use functions in C++. The video will cover how to define functions, how to call functions and how to create functions prototypes. Microsoft Visual C++ 2010 Express will be used as a text editor an…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now