Conversation

DCoder ๐Ÿ‡ฑ๐Ÿ‡นโค๐Ÿ‡บ๐Ÿ‡ฆ

fuck yeah, another ghidra feature that I could never find in IDA ๐Ÿ˜Ž

You can make a typedef for an offset pointer, as in, โ€œthis is a pointer to offset 0x4 within a FooClass objectโ€. And then the decompiler sees code like `SUB dword ptr [ESP + 0x8], 4` and figures out โ€œah, this turns it into a normal FooClass*โ€ and makes things readable. Quite nice for inspecting C++ inheritance forests.

2
1
1
@dcoderlt Reminded me of this project: https://github.com/astrelsky/Ghidra-Cpp-Class-Analyzer - it seems I have to look into recent advances in C++ class analysis in #Ghidra...
1
0
2

DCoder ๐Ÿ‡ฑ๐Ÿ‡นโค๐Ÿ‡บ๐Ÿ‡ฆ

@buherator
Neat link, thanks โ€” Iโ€™m just starting to work with ghidra, so all scripting examples are good :)

0
0
1

DCoder ๐Ÿ‡ฑ๐Ÿ‡นโค๐Ÿ‡บ๐Ÿ‡ฆ

@G33KatWork
Yes, thanks. Cool to see IDA has it as well :)

0
0
0