C your data structures with rellic-headergen

Summary: Trail of Bits released rellic-headergen, a tool built during an internship that converts LLVM bitcode type definitions into equivalent C struct definitions, matching the memory layout of the original C++ types. The tool builds a directed acyclic graph of type definitions and topologically sorts them to satisfy C's forward-declaration rules, then uses Clang to resolve field offsets, falling back to a manually padded packed layout when the direct layout does not match.
Bottom line: Reverse engineering tools that embed basic C parsers have no C++ support, so a tool that recovers exact struct layouts from debug metadata bridges that gap for analysts working on binaries built with debug information. The author notes the tool cannot resolve mismatches when optimization has stripped type information from the bitcode, and that Rust's ad hoc representation for discriminated unions is difficult for it to handle.

Read the original at Trail of Bits Blog ↗