9

So I want to define a c++ string in ghidra struct. I noticed while reverse engineering a C++ binary, I found that, it defines a basic_string class in the symbol tree.

Now I want to define a std::string (not a pointer to it) within a struct. Is there a way to do it automatically right now, or will I still need to manually define a basic_string struct and go from there? Is there currently a way to associate classes and structs together like so (currently I think classes only act as namespaces?

I also tried just simply adding a field with the type basic_string in my struct, but it complains that basic_string is just a placeholder struct.

Haven't yet tested how ghidra would handle a std::string local variable.

EDIT: example code for what I described above:

#include <string>
#include <iostream>

struct Human {
  int age;
  bool is_male;
  std::string name;

public:
  Human(int age, bool is_male, const std::string &name) : age(age), is_male(is_male), 
    name(name) { }

  void say_hello() {
    std::cout << "Hello, I am a " << (is_male ? "male " : "female ") << age << 
      "-year old named " << name << "!" << std::endl;
  }
};

int main() {
  Human *human = new Human(17, true, "Adam");
  human->say_hello();
}

When you putting this into ghidra, and then do auto-fill struct fields, it will recognize the age and is_male fields, but not the name field, as this is an opaque std::string object.

Up to this point, when I was reversing another (much larger) binary, I simply manually created a new struct:

struct basic_string {
  char *ptr;
  size_t len;
  char buff[0x10]
};

Is there something that ghidra can do this automatically? Also I'm wondering would there be any portability issues if I just always assume the above struct?

1 Answers1

2

EDIT: I misread the question. The solution I provided only shows how structures can be manually added. There does not appear to be a way in Ghidra to import a struct by text blob.


Yes.

To add a structure in Ghidra, you have to go to the Data Type Manager - for me it's the third frame on the left-most vertical pane.

enter image description here

  • Hmm yeah I guess that's what I figure... do you think ghidra would be implementing something like this in the future for c++ structs? – theKidOfArcrania Mar 10 '19 at 21:46