Inheritance and Polymorphism in C++ - Ghidra Reversing Tutorials

In this video, part 2 in the Ghidra Reversing Tutorials series, we'll take a look at several sample programs that use C++ objects, compile them from source and then reverse engineer them with Ghidra. Our goals will be to identify the size/structure of the memory allocation and how it's used by the object and explore the use of virtual functions and virtual function tables, inheritance and polymorphic behavior. Recognizing the use of C++ objects is helpful a variety of reverse engineering activities, to include malware analysis and software exploitation. This is the second video in a series exploring the reverse engineering of object-oriented languages.

Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🌶️ YouTube 👉🏻 Like, Comment & Subscribe!

[solveig]

Dr Stroschein,

First, thank you for such an excellent series on Ghidra! Such quality, student-oriented material is hard to come by... I have two questions about this video, though. (1) How exactly is the "private" nature of Ex2's var1 enforced...? As far as I can see, at the asm level, there is nothing private about it... and (2) did you by chance edit the video between 24:48 and 24:52...? Just curious why no one has mentioned this so far! I have been following the function addresses and was a bit thrown off when you started to discuss Ex5->virtual_func3 ^^

[bhimeshbhimesh]

hello Dr. Stroschein,
I am trying to create an executable in linux, throgh dynamic linking. however I get a linker error stating "....lmyuserdefinedlib.so: undefined reference to non-virtual thunk to Foam::rhoThermo::mu() const ....".
However I did define 'Foam::rhoThermo::mu() const' in other shared object. How could I fix such linker errors? unfortunately there is no proper examples out there..
any hints to fix the issue?

[netbat]

can you reverse kernel with this? It's worth to try!