x86 C++ Reverse Engineering

Overview

Reverse-engineers 32-bit little-endian x86 (IA-32) binaries compiled from C++. Front-loads mechanical ABI metadata extraction (vtable layouts, RTTI structures, base-class graphs, and symbol demangling) into structured JSON rather than burning context on raw assembly dumps. Degrades gracefully from automated tooling (recon.py, LIEF, radare2, OOAnalyzer) to standard binutils (objdump, readelf, nm, c++filt) and debuggers (gdb, windbg).

When to Use

• Analyzing 32-bit x86 ELF (.so, executables) or PE (.exe, .dll) binaries.
• Recovering C++ class hierarchies, member layouts, and virtual function tables.
• Identifying and resolving dynamic virtual call sites (call [eax + slot]).
• Reconstructing custom file-format loaders or flat procedural data tables.
• Mapping resource indices to code call sites (resource-binding recovery).
• Deciphering obfuscated assembly or anti-debugging mechanisms.

When NOT to use:

• 64-bit binaries (x86-64 / AMD64) — 4-byte pointer assumptions and ABI headers do not apply.
• Binaries in non-native languages (e.g. .NET/C#, Java bytecode, Python bytecode).
• Pure assembly without C++ abstractions or data structures where generic triage suffices.