CLASScanner: Efficient C++ Class Recovery from Binaries Driven by Object Flow Graphs

C++ class recovery is fundamental to reverse engineering, serving as a basis for critical downstream tasks such as vulnerability analysis, malware comprehension, and decompiler output optimization. Existing approaches face several challenges, including dependency on virtual function tables and a lack of support for non-polymorphic classes, dependency on high-quality test cases for dynamic analysis, and dependency on computationally expensive reasoning. Furthermore, existing rule-based techniques fail to recover class relationships in non-polymorphic classes, including inheritance and composition, thereby reducing fidelity to original program semantics. To address these problems, we propose CLASScanner, a novel approach for recovering C++ classes from stripped binaries. We design a data-flow abstraction, Object Flow Graph (OFG), to model the behaviors of objects across different contexts throughout their lifecycles. Driven by the OFG, CLASScanner identifies classes and recovers their attributes and methods. We further propose a progressive framework that synergizes static analysis with LLM-based reasoning to infer class inheritance and composition relationships. We evaluate CLASScanner on a dataset of real-world binaries comprising 167,982 functions. It achieved F1-scores of 95.4, 93.7, 75.4, 89.9, and 92.7 in recovering attributes, constructors, destructors, class inheritance, and class composition, respectively. Compared to state-of-the-art approaches, CLASScanner significantly improves the F1-scores while reducing runtime overhead, requiring only 10.3% of the execution time on average, making it promising for real-world reverse engineering tasks.