restorer

An application that allows you to recover header files for C++ classes and namespaces from dll and pdb files built by Microsoft Visual C++.

The current implementation just meets my requirements and is not a finished product.

• Tested on Windows only;
• Only x64 binaries supported.
• Not all MSVC build options that affect RTTI may be considered, resulting in incomplete or incorrect recovery.

Example

It easy to get current options with help:

$ restorer.exe --help

OVERVIEW: Class header dumper

USAGE: restorer.exe [options] <input object files>

OPTIONS:
--recursive            Collect all binary files recursively
--input-folder=path    Input folder path
--pdb-folder=path      Pdb folder path
--output-folder=path   Output folder path
--help                 Display available options

You can pass a list of dlls or a directory path (for recursive traversal) to the input and get a set of header files at the output, in which all the found characters keep their nesting.

$ ./restorer.exe libA.dll libB.dll

You can find here example folder with example.h header file. After restoration we get something like in example_restored.h.

How it works

• A lot of information can be obtained from decorated names.
• It is possible to restore the inheritance hierarchy if the library you are using uses Microsoft Visual C++ RTTI.
• PDB files can be used to obtain additional information that will increase the amount of information recovered.

We can represent the nesting of classes and namespaces in the form of a tree for each of the modules (exe/dll). Combined tree of all modules gives us a more complete picture, but this requires no collisions. The collected information is displayed in C++ header files, which can even be included in other C++ projects. Unfortunately, RTTI does not keep a list of class fields, so the task is much more complicated. At this point, the class fields need to be restored manually.

Another useful feature of this application is that it tries to restore virtual function tables while maintaining the original order of functions. If you are lucky and enough information is collected, you can get a class/struct definition that can be used to call virtual functions when developing plugins (get pointer in run-time and cast to restored type).

Requirements

• LLVM
• DIA (for processing PDB)

Possible improvement directions (TODO)

• Add a set of options for more flexibility;
• Full support for PDB processing (structure/class layout info)
• Restore fields lists for class/struct/union;
• Add also generation of source files (.cpp) for linkless function calling;
• Investigate Linux support;
• Make pre-built packages.

Inspiration and ideas

Thanks for idea to GrandpaGameHacker:

• ClassDumper
• ClassDumper2

LLVM:

• LLVM
• llvm-pdbutil
• llvm-readobj
• llvm-objdump

cmu-sei:

• Pharos Visual C++ Demangler - Another good library for demangling MSVC symbols that used before I found everything needed in LLVM.