Using pdb in OOAnalyzer

[dimitrijejankov]

Dear OOAnalyzer team,

Suppose I had access to more information about the types, like a .pdb file. Is it possible to explicitly bake in these
constraints into the prolog rules? If not could you give me a few hits on how to extend it? :)

[sei-eschwartz]

PDBs likely contain all the information you need. We actually use PDBs to extract ground truth for testing OOAnalyzer. Is there a reason you can't simply import the PDB into Ghidra/IDA?

[dimitrijejankov]

I don't have that one. Thanks for the replies :)

[sei-ccohen]

Github seems to be flaking out a little bit for me because your replies don't always show. I agree that it would be nice to be able to supplement facts from another source, whether it be a PDB or manual analysis from a related executable. We've talked about this a little, but it gets very complicated because you don't really know what's the same and what has changed between the files, and because OOAnalyzer work on addresses, it's hard to tie the user-supplied facts to the discovered classes.

OOAnalyzer uses the RTTI, and should do pretty well on the classes that have RTTI. It'll be the classes without RTTI that are likely to give you the most trouble. It's a hard problem, which is why we've been building a tool to help. ;-)

[dimitrijejankov]

I kicked of OOAnalyzer on the binary, and the prolog part crashed. The log said to send that there might be a problem with the rules. Here is my working directory if you guys want to debug this.
https://drive.google.com/file/d/17_oDVPboGUULuW4hajL4ywnJehgazx9L/view?usp=sharing

[edmcman]

I don't have permission to view the file on drive.

Can you create a new issue for this problem?

[dimitrijejankov]

just did that :)