mirror of
https://github.com/NohamR/Reclass.git
synced 2026-05-10 19:59:21 +00:00
b4727df3e9
Implement macOS-specific support for the ProcessMemory plugin and update plugin discovery/build. - Add macOS build/install support: include plugins/ProcessMemory in top-level CMake and copy the built plugin into Reclass.app/Contents/PlugIns on macOS. - Implement Apple-specific ProcessMemoryProvider: task_for_pid usage, mach_vm_read_overwrite/mach_vm_write, proc_pidpath/proc_regionfilename based module caching, region enumeration, symbol formatting, module enumeration, and proper cleanup (mach_port_deallocate). - Extend plugin header to track m_task and adjust readability checks for macOS. - Add macOS handling in getInitialBaseAddress and process enumeration to find base addresses and processes using proc APIs. - Improve PluginManager to probe multiple plugin locations (including Contents/PlugIns inside macOS bundles), aggregate/log candidate counts, and continue scanning multiple dirs. - Add macOS screenshot to README (docs/README_PIC6.png) and reference it in README. These changes enable the ProcessMemory plugin to operate on macOS and make plugin discovery more robust on macOS app bundles.
198 lines
9.4 KiB
Markdown
198 lines
9.4 KiB
Markdown
<div align="center">
|
|
|
|
<picture>
|
|
<source media="(prefers-color-scheme: dark)" srcset="docs/RECLASS_LIGHTMODE.svg" height="170">
|
|
<img src="docs/RECLASS_DARKMODE.svg" alt="Reclass" height="170" />
|
|
</picture>
|
|
|
|
**A structured binary editor for reverse engineering — inspect raw bytes as typed structs, arrays, and pointers.<p>Built from scratch as a modern replacement for ReClass.NET and ReClassEx**
|
|
|
|
[Download](https://github.com/IChooseYou/Reclass/releases) · [Build Instructions](#build) · [MCP Integration](#mcp-integration) · [Alternatives](#alternatives)
|
|
|
|
[](https://github.com/IChooseYou/Reclass/actions/workflows/build.yml)
|
|
[](LICENSE)
|
|
[](https://github.com/IChooseYou/Reclass/releases)
|
|
[]()
|
|
|
|
</div>
|
|
|
|
Reclass helps you inspect raw bytes and interpret them as types (structs, arrays, primitives, pointers, padding) instead of just hex. It is a debugging tool for figuring out unknown data structures — either at runtime from a live process, or from a static source like a binary file or crash dump.
|
|
|
|
Built with C++17, Qt 6 (Qt 5 also supported), and QScintilla. The entire editor surface is rendered as formatted plain text with inline editing, fold markers, and hex/ASCII previews.
|
|
|
|
## Screenshots
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Features
|
|
|
|
### Editor
|
|
|
|
- **Structured binary view** — render raw bytes as typed fields with columnar alignment
|
|
- **Inline editing** — click to edit type names, field names, values, base addresses, array metadata, pointer targets, enum members, bitfield members, static expressions, and comments — all with real-time validation
|
|
- **Tab-cycling** — tab through editable fields within a line
|
|
- **Type autocomplete** — cached popup type picker with search/filter for struct targets
|
|
- **Multi-select** — Ctrl+click individual nodes or Shift+click for range selection
|
|
- **Split views** — multiple synchronized editor panes over the same document
|
|
- **Find bar** — Ctrl+F in-editor search with indicator highlighting
|
|
- **Fold/collapse** — expand and collapse structs, arrays, and pointer expansions with embedded fold indicators
|
|
- **Hex + ASCII columns** — raw byte previews alongside the structured view with per-byte change highlighting
|
|
|
|
### Live Memory Analysis
|
|
|
|
- **Auto-refresh** — configurable interval (default 660ms) with async page-based reads for non-blocking UI
|
|
- **Value history & heatmap** — per-node ring buffer (10 samples with timestamps), color-coded heat indicators (static/cold/warm/hot) based on change frequency
|
|
- **Changed-byte highlighting** — per-byte change indicators within hex preview lines
|
|
- **Memory write-back** — edit values inline, writes propagate through the provider to live process memory
|
|
- **Pointer chasing** — automatic reads of dereferenced memory regions across pointer chains
|
|
- **Address parser** — formula expressions like `<module.exe>+0x1A0`, pointer dereference chains, symbol resolution
|
|
|
|
### Undo / Redo
|
|
|
|
Full command stack with 15 undoable operations: ChangeKind, Rename, Collapse, Insert, Remove, ChangeBase, WriteBytes, ChangeArrayMeta, ChangePointerRef, ChangeStructTypeName, ChangeClassKeyword, ChangeOffset, ChangeEnumMembers, ChangeOffsetExpr, ToggleStatic. Batch macro support for multi-node operations.
|
|
|
|
### Import / Export
|
|
|
|
| Format | Import | Export |
|
|
|--------|:------:|:------:|
|
|
| **Native JSON (.rcx)** | Full tree + metadata | Full tree + metadata |
|
|
| **C/C++ source** | Struct/class/union/enum parsing with offset comments | Header generation with optional static asserts |
|
|
| **ReClass XML** | Full compatibility with ReClass Classic | Full compatibility |
|
|
| **PDB symbols (Windows)** | UDT enumeration with selective recursive import via raw_pdb — no DIA SDK dependency | |
|
|
|
|
### Workspace & Navigation
|
|
|
|
- **Multi-document tabs** — MDI interface, one document per tab
|
|
- **Workspace dock** — project explorer tree with struct/enum/union icons, sorted by field count, quick navigation to members
|
|
- **Scanner dock** — integrated memory search panel
|
|
- **Dual view mode** — switch between ReClass tree view and rendered C/C++ output per tab
|
|
- **View root** — focus on a specific struct, hiding all others
|
|
- **Scroll to node** — programmatic navigation to any node by ID
|
|
|
|
## Data Sources
|
|
|
|
- **File** — open any binary file and inspect its contents as structured data
|
|
- **Process** — attach to a live process and read its memory in real time (Windows/Linux)
|
|
- **Kernel driver** — Windows kernel driver (IOCTL) for process memory, physical memory, page table walking, and CR3/VTOP translation
|
|
- **Remote Process** — read another process's memory over TCP with cross-architecture 32/64-bit support
|
|
- **WinDbg** — connect to live WinDbg debugging sessions or load crash dumps
|
|
- **Saved sources** — quick-switch between recently used data sources per tab
|
|
|
|
## Plugin System
|
|
|
|
DLL plugins loaded from a `Plugins` folder, auto or manual.
|
|
|
|
**Bundled plugins:**
|
|
|
|
| Plugin | Description |
|
|
|--------|-------------|
|
|
| **Process memory** | Attach to local processes on Windows and Linux — PID-based, with symbol resolution and module/region enumeration |
|
|
| **Kernel memory** | Windows kernel driver (IOCTL) for reading/writing process and physical memory, CR3 queries, virtual-to-physical translation, and full 4-level page table walking — supports 4KB, 2MB, and 1GB pages |
|
|
| **WinDbg** | Access data from live WinDbg debugging sessions |
|
|
| **Remote process memory** | TCP RPC-based remote process access with cross-architecture support |
|
|
| **ReClass.NET compatibility** | Load existing ReClass.NET native DLL plugins directly; optional .NET CLR hosting for managed plugins |
|
|
|
|
## MCP Integration
|
|
|
|
Built-in [Model Context Protocol](https://modelcontextprotocol.io/) bridge via `ReclassMcpBridge` — the first reverse engineering tool with native AI/LLM integration. The server uses JSON-RPC 2.0 over named pipes and can be toggled from the Tools menu or auto-started on launch.
|
|
|
|
**Available tools:**
|
|
|
|
| Tool | Description |
|
|
|------|-------------|
|
|
| `projectState` | Read current tree structure, base address, tab state |
|
|
| `treeApply` | Apply structural command deltas to the node tree |
|
|
| `sourceSwitch` | Switch the active data source |
|
|
| `hexRead` | Read bytes at an address |
|
|
| `hexWrite` | Write bytes at an address |
|
|
| `statusSet` | Update the status bar text |
|
|
| `uiAction` | Trigger menu actions programmatically |
|
|
| `treeSearch` | Search nodes by name or type |
|
|
| `nodeHistory` | Query value change history for a node |
|
|
|
|
**Notifications:** `notifyTreeChanged`, `notifyDataChanged`
|
|
|
|
A standalone stdio-to-pipe bridge binary is built alongside the main application. To connect, add this to your MCP client config (e.g. `.mcp.json`):
|
|
|
|
```json
|
|
{
|
|
"mcpServers": {
|
|
"ReclassMcpBridge": {
|
|
"command": "path/to/build/ReclassMcpBridge",
|
|
"args": []
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
## Build
|
|
|
|
### Prerequisites
|
|
|
|
- **Qt 6** (or Qt 5) with MinGW — [Qt Online Installer](https://doc.qt.io/qt-6/qt-online-installation.html) (select MinGW kit + CMake/Ninja from the Tools section)
|
|
- **CMake 3.20+** — [cmake.org](https://cmake.org/download/) (bundled with Qt)
|
|
- **Ninja** — bundled with the Qt installer
|
|
|
|
### Quick Build
|
|
|
|
```bash
|
|
git clone --recurse-submodules https://github.com/IChooseYou/Reclass.git
|
|
cd Reclass
|
|
.\scripts\build_qscintilla.ps1
|
|
.\scripts\build.ps1
|
|
```
|
|
|
|
The build script auto-detects your Qt install location.
|
|
|
|
### macOS Build
|
|
|
|
```bash
|
|
./scripts/build_macos.sh --qt-dir /opt/homebrew/opt/qt --build-type Release --package
|
|
```
|
|
|
|
If you installed Qt via Homebrew, `--qt-dir /opt/homebrew/opt/qt` is typical on Apple Silicon. You can also set `QTDIR` or `Qt6_DIR` instead of passing `--qt-dir`.
|
|
|
|
Note: macOS Gatekeeper may block unsigned apps. If the app won't open, go to **System Settings > Privacy & Security** and click **Open Anyway**.
|
|
|
|
### Manual Build (MinGW)
|
|
|
|
1. Clone with `--recurse-submodules` (or run `git submodule update --init --recursive` after cloning)
|
|
2. Build QScintilla: `qmake` + `mingw32-make` in `third_party/qscintilla/src`
|
|
3. Configure and build:
|
|
```bash
|
|
cmake -B build -G Ninja -DCMAKE_PREFIX_PATH=/path/to/Qt/6.x.x/mingw_64
|
|
cmake --build build
|
|
```
|
|
4. Optionally run `windeployqt` on the output executable
|
|
|
|
### Visual Studio 2022+
|
|
|
|
The `msvc/` folder contains a ready-made solution (`Reclass.slnx`) with projects for the main application, all plugins, and third-party libraries. Requires the [Qt Visual Studio Tools](https://marketplace.visualstudio.com/items?itemName=TheQtCompany.QtVisualStudioTools2022) extension with a Qt 6 MSVC kit configured.
|
|
|
|
### Running Tests
|
|
|
|
```bash
|
|
ctest --test-dir build --output-on-failure
|
|
```
|
|
|
|
30 tests covering composition, serialization, undo/redo, import/export, provider switching, type visibility, validation, scanning, and rendering.
|
|
|
|
## Alternatives
|
|
|
|
- [ReClass.NET](https://github.com/ReClassNET/ReClass.NET)
|
|
- [ReClassEx](https://github.com/ajkhoury/ReClassEx)
|
|
|
|
<div align="center">
|
|
<sub>MIT License</sub>
|
|
</div>
|