I am trying to reverse engineer some C++ code that was made by "architecture astronaut", having multiple layers, lots of virtual functions, lots of polymorphism, metaprogramming, inlined stuff, and so on.
I know that generating C++ from machine code is an almost absurd idea, but what I am looking for is a tool to help me organize information.
Example of features that I would appreciate: support navigating through code by vtables (ie: after you manually find all relevant vtables, you point them to the program, and clicking on a code that jumps to member "6" of the vtable jumps to that function, if this is ambiguous due to various vtables being possible, it asks you what vtable you want).
Easy editing of nested structures (example: instead of defining a class as a struct myClass { myBase baseClass; int someInt;};
you can actually see "myBase" contents inside "myClass" and even edit it, without having to edit the separate structures.
Support for STL names (extremely long names, names with <>: , characters in it)
Being able to tag some code as "copy and paste" of another code, at least in a highlight manner, so you can more easily see what is going on (for example for heavily inlined code, templates, metaprogramming abuse, and so on).
Being able to organize and compare vtables, suppose you have 1 base vtable that is almost entire pure virtual functions, and 2 vtables that override it later, then you can compare all 3, and know what is what (for example you know what functions are overriding the pure virtual functions, and thus if you have debug symbols or something figure the name of the original pure virtual functions).
Being able to merge structs (suppose you find functions of a class all over the code, and create a struct for each one, eventually you find it is the same class)
Being able to give "fake names" to entries on vtable (suppose you know the correct name of a function in a vtable, also the compiler optmized away this function because it was identical to other unrelated function, this way you can use the original name, instead of seeing A::func1(); A::func2(); B::func47(); A::func4();
Also, CodeXplorer don't fix any of the issues I mentioned, at all... AND cause some serious bugs (infinite loops, creating bogus structures while debugging, and several other extremely aberrant behaviour, including making IDA crash a couple times).
– speeder Jan 27 '16 at 03:34This question was an attempt to ask in a different manner and see what would be the result, maybe someone would suggest something useful. (example: the CodeXplorer wasn't a bad suggestion, I am already using it, but it doesn't fix the specific issues I mentioned)
– speeder Jan 29 '16 at 16:02