2015 - Eugene Rodionov & Aleksandr Matrosov - OO RE with HexraysCodeXplorer

Eugene Rodionov presents practical approaches to reverse engineering object-oriented C++ malware using Hex-Rays decompiler and IDA Pro, introducing Hex-Rays CodeXplorer, a plugin for automating type reconstruction. The talk emphasizes that C++ reversing differs significantly from C analysis due to virtual function indirection, template instantiation, and runtime type information (RTTI), making malware analysis substantially more complex.

**Why C++ Reversing Is Difficult** The speaker contrasts simple C code with C++ using virtual methods. Virtual functions prevent direct method calls; instead, pointers are stored in virtual function tables (vtables) initialized during object construction. This indirect calling mechanism complicates static analysis since the analyst cannot determine execution targets without tracking objects to their creation and examining their vtables. C++ templates exacerbate analysis by generating unique binary code for each instantiation (Vector<int>, Vector<string>, etc.), preventing signature-based identification of standard library code. RTTI, when present, stores type metadata and class hierarchies but is compiler-specific and optional.

**Real-World Malware Examples** The presentation examines two sophisticated campaigns:

**Flame/Flamer (2012)**: A 6MB statically linked binary featuring a complex object-oriented framework including a vector of task objects executed in threads, specialized modules (M for fake Windows Update delivery, Ider for scheduling, Beetle Juice for Bluetooth propagation, Frog for replication), consumer objects as event triggers, and common executors for C2 dispatching. Extensive use of smart pointers, custom vectors, and strings comprises ~70% of analysis effort. Despite lacking RTTI, the malware authors left task names in configuration data aiding reverse engineering.

**Operation Sandvine (ex-agent)**: A modular framework enabling cross-platform deployment (Windows, Linux, macOS) with standardized I_agent_module interface, agent kernel providing storage and cryptographic services, channel controller for HTTP-based C2 multiplexing, and specialized modules (filesystem, key logger, process executor, remote shell). Uses standard C++ STL containers making analysis more straightforward.

**Type Reconstruction Methodology** Rather than reconstructing control flow graphs, C++ malware analysis prioritizes type recovery: identifying constructors (memory allocation plus pointer assignment patterns), reconstructing object attributes via C structures, building vtable representations, and extracting class hierarchies using RTTI when available.

**Hex-Rays CodeXplorer Tool** The plugin leverages Hex-Rays' C3 syntax tree (intermediate representation supporting x86, x64, ARM) to automate type reconstruction. The tool scans for vtable patterns, identifies constructors, monitors specific C3 tree nodes (M_PTR for pointer dereferencing, assignments, array indexing, calls), automatically generates C structures describing object layouts, and creates vtable structures. A special NorthSec conference edition includes automatic virtual table identification and type reconstruction. The demonstration reconstructed agent_kernel and channel_controller types from ex-agent, automatically identifying field offsets and types, enabling readable decompiled code.

**Future Development** Planned improvements include porting from C++ to IDA Python for better SDK compatibility, adding GCC compiler support (currently Visual C++ only), implementing cross-reference tracking for object field usage, and developing data-flow-based code similarity detection resistant to compiler optimizations like inlining and frame pointer elimination.