Igor’s Tip of the Week #142: Mapping local types

When working on a binary, you often recover types used in it from many sources:

• creating structures manually, from data, or using decompiler;


• 
  parsing header files;


• importing them from type libraries or debug information;

However, it may happen that eventually you discover duplicates. For example, you find out that the “custom” structure you’ve been building up is actually a well-known type and you found the correct definition in debug info or header files. Or, after analyzing …

binary data debug decompiler discover files find header information local malware analysis mapping may parsing recover types working