ReClass aka Structbuild 2

[DrUnKeN ChEeTaH]

This is a complete rewrite of the original StructBuild code.

Purpose:
This is a tool to help reverse structures/classes for games that don't have an SDK.

Features:
Advanced GUI - Skinning, Window Panes, custom toolbars
Speed - it can handle much larger structs/classes faster!!
Multiple everything - selection, convert, delete, even structs/classes
Baseclass - create classes to be used as a base, or inserted into exsisting classes
Headers/Footer - add your own code to the created SDK
Modify - You can now change selected memory (zero,random)
Hide - Remove selected memory
Custom Type - Now not limited to "basic" types
Notepad - save notes and important info into your project files
much more...

checkout the "readme.txt" and watch the included video


If you find this program useful, Please consider posting your files for others
to learn from. This includes me, as most of the new stuff came from looking at
what was created from the original structbuild.


updated:
http://rapidshare.com/files/124302465/ReClass_v1.0.4.rar

Thanks to my testers:
Patrick, Tammi, Strife

[bobbysing]

good job

[Musolini123456]

I have a bug. (I am on a windows XP SP2)
http://img246.imageshack.us/my.php?image=bugjk1.jpg


I saw the video good work.

[Alkatraz]

Great job DC! You have put a lot of work into this one. And it has defiantly payed off.

[xanad]

Thank You very much for sharing and for your work... gj

[bobbysing]

Here's another bug:
If you use "&" to name anything, a "_" is under the next character and the "&" is a space:
In "void Func( int &Var )" the "_" is under the "V" and "&" is a space.

[Gna]

nice one:> but i miss the debuger :> it was a usefull thing:>

nice gui and selecting features its a realy great prog:>

[kynox]

Awesome work, definitely a lot better than the original. Good job DC

[DrUnKeN ChEeTaH]

I have a bug. (I am on a windows XP SP2)
http://img246.imageshack.us/my.php?image=bugjk1.jpg


I saw the video good work.

Looks like a font issue, have you installed any font packs?

*I use the plain "terminal" font, maybe check your windows fonts and remove any
Installed using that facename.

[Trundle]

Awesome application. Thank you very much.

[guy12]

A very professional tool, which can be widely used not only for boring game hacking.
THANKS !

[MyZt]

Good job with this app.. tried it on a little now, didn't use Structbuilder and I'm used to using Notepad / Pen&paper to map out classes, and this program actually impressed me a little bit! :)

One thing that could be improved tho is when I map out really big classes I put some of the data Hidden because it's not relevant at that moment, then I want to show some other data and then there's only "UnHide All" availible which kinda makes everything messy..
But still, nice application :)


which can be widely used not only for boring game hacking.
Yeah, it can be used for fun game hacking too! ;)



Edit: After writing the post I went back to the program and put a hidden block of data as a text-string.. which made the program crash.. a little bug-report! :/

Bug 2: Maybe I'm just doing it wrong, but I save a project, then when I try to open it all the classes are gone.. hmm..

[master_beta]

I have a bug. (I am on a windows XP SP2)
http://img246.imageshack.us/my.php?image=bugjk1.jpg


I saw the video good work.

I have the same problem and I'm pretty sure I didn't install any extra fonts. Could it be resolution (1680x1050)?

[MyZt]

I have the same problem and I'm pretty sure I didn't install any extra fonts. Could it be resolution (1680x1050)?
I'm running 1680x1050 on Vista and it's fine for me.

[DrUnKeN ChEeTaH]

I can confirm the Hidden to Text as a bug..thanks

You can unhide single sections by double clicking, so you don't have to use unhide all if that's what you mean.


If your class doesn't have any memory definded other then hex, then it will be erased. so if you just made a few classes and renamed them, it will still remove it.

The projects are simple sqlite databases so you can open and view them using this:
http://sqlitebrowser.sourceforge.net/index.html

I'll add an option for changing fonts, and that should fix the other problems.

[fliptox]

very ncie work

[DrUnKeN ChEeTaH]

30-12-07 Bug Fixes 1.0.2
*Added: Font selection
*Fixed: Printing "&" problems
*Added: Debugger
*Added: Disassemble Pane


I've added a font selection, I suggest a small fixed width font for the best display.
*Still defaults to terminal 6pt

Fixed the "&" display problem

Added the Debugger from the original StructBuild, not tested on Vista
This will let you attach to a process, and log all accesses to the selected memory address.

Added the Disassemble pane for checking out virtual functions

Temp Fix: Hidden to Text bug (this bug uncovered other bugs, but this should keep it from crashing in this case. will be fixed later)


Download:
http://rapidshare.com/files/80030496/ReClass1.0.2.rar

[Gordon`]

wow... very cool :D

[MyZt]

Added the Debugger from the original StructBuild, not tested on Vista
This will let you attach to a process, and log all accesses to the selected memory address.
Tested in Vista x64 Ultimate on Battlefield 2 and Minesweeper, I get "Failed to attach" when trying to attach.

[CodeCafe]

Hmm, how would I go about mapping the situation where a class contains a pointer to another class of the same type (like a linked list pointing to nodes)? Everytime I try the pointer to class option it crashes (recursive crash I guess)
Eg:


struct Foo
{
Foo* previous;
Foo* next;
};

[DrUnKeN ChEeTaH]

For now use the "Custom" Type, like so:

[img=http://img215.imageshack.us/img215/1198/rcwp0.th.jpg] (http://img215.imageshack.us/my.php?image=rcwp0.jpg)


----

MyZt did you try that using "Run as administrator" or turning off UAC? I would think you would need it running as admin to debug another process.

[MyZt]

MyZt did you try that using "Run as administrator" or turning off UAC? I would think you would need it running as admin to debug another process.
Yes, forgot to write that, UAC is completely off.
Debugging with OllyDBG works fine..

[temp2]

Added the Disassemble pane for checking out virtual functions


Very nice DC. But tell me why did you not integrate this as a plug-in for IDA Pro?

[DrUnKeN ChEeTaH]

Very nice DC. But tell me why did you not integrate this as a plug-in for IDA Pro?

Just wanted a stand alone tool, but I do see how this could be used not only for IDA but as an Olly plugin.

I can post some code if you would like to make an IDA plugin to create/update structs.

[temp2]

I can post some code if you would like to make an IDA plugin to create/update structs.

Yeah that would be cool. IDA Pro dissasembly really rocks when you know the structures. There is an IDA pro plugin that uses the emulator, identically names BTW, that is meant 2 create structures automatically from the dissasembly ... never got it to work though...

[bobbysing]

ReClass 1.0.2 crashes when generating headers using the class structure I attached.

[DrUnKeN ChEeTaH]

Thanks, found the bugs I think.

Also this has also showed me a "rule" I should have posted.

Don't rename VTABLE classes for now, as that name is used as a "Marker".
*if you rename it, it will make a class full of "errors", to fix your project rename CGObject_C_VTABLE back to just VTABLE


This is a quick bugfix for the above issues:
http://rapidshare.com/files/83324062/ReClass_1.0.3.rar

---------

Next version I'll include some IDA options, and some sample code.
I'm thinking it would be ease to gen an IDA script to create the structs instead of a full plugin.

[zoomgod]

Sorry to bump old thread but...

DC, this thing is awesome, I like it much more than structbuild. Was wondering about a feature request if I can explain it clearly...

Would be great to be able to be in a class you already defined and have a search that can follow any pointers (assume it's a new class) within X bytes and then look for a given value of a given type, say within 1k bytes or so.

This would come in handy when your working on large sets of classes and you know that under this class you should find that "target" value somewhere.

Anyway, works great, has helped my 2142 project out tons...

Thanks

[kynox]

Now that its bumped, is there any chance of adding a char* type to this DC? Custom is all well and good but then you don't get to see the string :p

[DrUnKeN ChEeTaH]

I'll try to do better and include a plug-in sdk so people can add their own types like STL, DirectX etc..

Not sure when, but this is a tool I use and update as I find missing features.

[kynox]

Wow, that sounds awesome! gj!

[MasterRed]

Hey,
I don't know if your are still developing this tool but I wanted to leave some feedback anyhow.
I have been using the your original tool 'structbuild' which is a very nice tool but has some annoying bugs.
Now I tested your new tool which is a very big improvement, good job!
However I still miss some things and have some bugs.

- I miss the variable colors that were in structbuild. (e.g int32 was red, float blue, DWORD green )
I find that made the struct/class more readable. So I could easy distinguish between variables I had named and the ones that were still 'unknowns'.

- When naming variables you have to press enter or click an other option in the properties window for it to be set.
It would be nice it automatically did that on every new character that got entered like in structbuild.
Example: i want to name a variable at offset 0x10 to 'foo'.
I click the 0x10 offset and enter 'foo' in the properties windows. (now the name is still not really 'set' it only will be when I press enter or click some other field in the properties window).
Then I want to name the next variable at offset 0x14 to 'foo2'.
So I click at offset 0x14, now this offset will have the name 'foo' and the variable at 0x10 still has the old name like ID025BE098.

- When inserting a class or any other data type bigger then 4 bytes will make all variables after this offset shift down.
Example: I have a class with a size of 0x20.
In the beginning only know that variable at 0x1C = int32 'foo'.
Later I see that offset 0x4 is a vector with x,y,z position.
I make a class called vector with size 0xC and variables x,y,z.
I go back to the other class and insert class vector at offset 0x4.
now the size of the class became 0x2C and the variable I named 'foo' at offset 0x1C got shifted down to offset 0x28.

- When choosing a new data type for an already named variable resets the name.
Example: I make a new class.
I select offset 0x4 and make it int32 and name it 'foo'.
I decided its actually an unsigned int(long) so I select offset 0x4 and make it DWORD.
Now the name is reset to some standard random name like 'ID025CC6C0'

These are first few things I noticed, I still haven't used the tool very much so there might be some other bugs / problems I have not come across yet.
I hope you will look into these problems it would really make this tool more usable.
For the rest I really like all the improvements over the old structbuild.
Thanks a lot for this tool.

[Xero|Hawk]

Furthermore I noticed that the actual header generation is a bit buggy as well.
The different classes arent generated in the right order for example, so if class A uses class B, class A could still be ABOVE class B in the .h file (if created in that order inside ReClass), which leads to a compiler error.
Besides the classes arent closed with a ";", so you have to do that manually.
Other than that (and the points mentioned above), you really did a good job!
Xero|Hawk

[DrUnKeN ChEeTaH]

I've been too busy to work on ReClass lately, and wanted to add more features before releasing the next version.

However, here is the latest version I was working on that includes a few fixes like the ";" bug.

As for the class order, that is why all classes are declared first so you must not be including that code:

This compiles fine, and should follow your example:


class A;
class B;

class A
{
public:
B* pClassB; //0x0000
char unknown4[60]; //0x0004
};//Size=0x0040(64)

class B
{
public:
char unknown0[64]; //0x0000
};//Size=0x0040(64)




http://rapidshare.com/files/124302465/ReClass_v1.0.4.rar

[P47R!CK]

Thanks DC :D

[Xero|Hawk]

Thanks a bunch for the fast reply! Really nice to see our feedback actually being taken care of :biggrin: (unlike the feedback of the CoD4 community for example rofl... they are still waiting for an actual patch xD)
Xero|Hawk

[atom0s]

Just got this for the first time, awesome tool. Great work. :)

[wrongnick]

very cool tool indeed :)
only the minor bugs makes it use pain in the ass :-(
when i work on bigger classes with several thousand bytes the shifting becomes a big problem. when i change some bytes in the upper part, all the parts below become somehow shifted and sometimes renamed

nice job, keep it going!

[Hax4ever]

going to use it on cod4.

thanks for this aw some release

[learn_more]

this application is very usefull, thanks for your great work

some comments:

buttons missing tooltip:
*set selected mem to 1 (the zeromem and random mem near it do have tooltips)
*add 1024 bytes

imo it would be nice if there was a right click menu when a line is selected to change the type

[K@N@VEL]

The about box version still states 1.0.3 :tongue:

[learn_more]

well, i was toying somewhat with this application today, and i must say:
it is very usefull!!!

is it possible to create an array? (3 floats for a vec3 or something like that)

and maybe this would be usefull to add by default:
#pragma pack(1) (before oddly sized structs :) )

as for the class order:
it also complains about that here, even while including those forward declarations, very odd!

[kynox]

well, i was toying somewhat with this application today, and i must say:
it is very usefull!!!

is it possible to create an array? (3 floats for a vec3 or something like that)

and maybe this would be usefull to add by default:
#pragma pack(1) (before oddly sized structs :) )

Create a vector structure, insert the class.

[learn_more]

i created a class like this now:

class vec_3
{
public:
float a; //0x0000
float b; //0x0004
float c; //0x0008
};//Size=0x000C(12)

is that what you mean?

what i wanted is:

class vec_3
{
public:
float a[3];
};

[K@N@VEL]

You can always use the custom type to make vec3t arrays or pointers or anything u need really, do click custom and make it what u want for instance:



custom vec3_t[3];


When u generate the header file the "custom" keyword will be dropped and you are left with:



vec3_t[3];


Pretty easy and with that custom setting u can basically use it as any datatype, The program is amazingly helpful when it comes to reversing classes/structs ..

[learn_more]

how to crash it:

1 hide a few bytes
2 select the hidden text
3 insert some bytes

[MulleDK19]

Any updates on this tool?

It's extremely useful. However it does have a few bugs that makes it difficult.

Such as the following scenario:


class Player
{
int Health;
int Ammo;
Player* LastDamageFrom; //This will make ReClass freeze (I'm assuming it's because it's trying to draw the class infinitely)
};

[JaasonBourne]

oh, this cool oO

[console]

Any updates on this tool?

It's extremely useful. However it does have a few bugs that makes it difficult.

Such as the following scenario:


class Player
{
int Health;
int Ammo;
Player* LastDamageFrom; //This will make ReClass freeze (I'm assuming it's because it's trying to draw the class infinitely)
};

Had a similar problem. You will need to do this unless other ways are implemented:


For now use the "Custom" Type, like so:

[img=http://img215.imageshack.us/img215/1198/rcwp0.th.jpg] (http://img215.imageshack.us/my.php?image=rcwp0.jpg)


----

MyZt did you try that using "Run as administrator" or turning off UAC? I would think you would need it running as admin to debug another process.


oh, this cool oO

agreed.

[Subjunky]

can someone reup this please? seems to be deleted on rapidshare

[shikken]

requesting reupload

[Macpunk]

I wanna confirm this working great in Wine on Ubuntu 10.10/x64. I just downloaded it the other day to see what all the fuss is about. Quite an awesome app.

[RazoRapid]

I've got only old 1.0.2 version

[stev3]

http://www.ucdownloads.com/downloads/downloads.php?do=file&id=2808
http://www.ucdownloads.com/downloads/downloads.php?do=file&id=2809

any help?

[atom0s]

Attached to post (v1.0.4) so you don't have to deal with UCs crap.

[Subjunky]

thanks stev3 and atom0s