CODEWITHSUNDEEP
classassemblyx86-64reverse-engineeringsymbols
IHateAndLoveASM
IHateAndLoveASM

Reputation: 21

Finding class and function names from an x86-64 executable

I am wondering about if it is always possible, in some way to obtain the function and class names when reversing an application. (in this case a game) I have tried for around 1 month to reverse a game (Assassin's Creed Unity (anvil engine)) but still no luck getting the function names. I have found a way to obtain the class names but no clue on function names. So my question is, is it possible to actually obtain the function name out having the documentation, and create a hierarchy. (I ame doing this to get better at reversing and to learn new things (asm x64))

Any tips and tricks related to reversing classes/structers are appreciated.

Upvotes: 2

Views: 991

Answers (1)

Peter Cordes
Peter Cordes

Reputation: 364210

No, function and class names aren't needed for compiled code to work, and usually aren't part of an executable that's had its symbol table stripped.

The exception to that would be calls across DLL boundaries where you might get some mangled C++ names containing function and class names, or if there are any error-check / assert messages in the release build then some names might show up in strings.

C++ with RTTI (RunTime Type Info) might have type names somewhere, maybe mapping vtable pointers to strings, or for classes with no virtual members probably only if typeid was ever actually used. (Or not at all if compiled with RTTI disabled. activate RTTI in c++)

Even exception-handling I think doesn't need class names in the binary.

Other than that, there's no need for class names or function names in the compiled binary. Definitely not in the machine code itself; that's of course all pointers / relative offsets, even for classes with virtual functions. How do objects work in x86 at the assembly level?.

C++ does not generally support introspection, unlike Java, so there's no default need for any of the info you're looking for to be in the executable anywhere.

Upvotes: 3

Related Questions