C++ Unwind Exception Metadata: A Hidden Reverse Engineering Bonanza

The worst part of reverse engineering C++ programs -- or really, any program that uses custom structure types with no definitions provided -- is that information about structures is often incomplete, sporadic, and isolated. Consider the following function: From this code, we can infer that rcx points to a struct that has a QWORD -sized field at offset +0x70 . However, from this code alone, we…