Home / Forums / Reconstructing C++ Structs & Class Layouts from DWARF & PDB Symbols

UnreliableCode Community

Developer Research, Reverse Engineering & Coding Community

Subforums Leaderboard Log In to Post
Tutorial

Reconstructing C++ Structs & Class Layouts from DWARF & PDB Symbols

StructMapper
SDK & Class Builder
MEMBER
Rep: 160
Join Date: May 2024
Posts: 26
Thanks: 39
3y ago · Mar 12, 2023 11:31 AM
#1
Parsing PDB (Program Database) stream records with DIA SDK or LLVM PDB libraries extracts complete typedefs, member offsets, and vtables.
StructMapper | ReClass.NET & Class Layouts
The following users thanked StructMapper for this post:
HexRays99
Senior Reverse Engineer
VIP
Rep: 380
Join Date: Apr 2022
Posts: 36
Thanks: 94
3y ago · Mar 12, 2023 4:17 PM
#2
For Linux/Android binaries, DWARF .debug_info section contains DIE (Debugging Information Entry) tags mapping all struct members.
HexRays99 · Reverse Engineering & Static Analysis
CPP
// Always check your pointers!
if (!pLocalPlayer) return;
PEHeader
PE Format & Linker Tech
VIP
Rep: 350
Join Date: Jun 2023
Posts: 35
Thanks: 95
3y ago · Mar 14, 2023 8:17 PM
#3
Automated tools like PDBRipper and CVdump make dumping SDK headers from debug builds effortless.
PEHeader | IMAGE_NT_HEADERS & Section Parsing