I am trying to reverse engineer a game, for modding purposes.

The game is a behemoth, by using a GCC RTTI + Debug Symbol analysis script, I found out it has 1674 unique classes, some of them inherit from 4+ direct bases, and 10+ indirect bases, sometimes in diamond-shape style (example: the program has a custom implementation of Microsoft's IUnknown class, often classes with multiple inheritance have IUnknown multiple times in the hierarchy).

I am finding very hard to document what I am seeing to become able to more easily follow vtable calls inside the program, specially because the build I actually want to reverse engineer is NOT the one that had the symbols, thus I need to manually port over information anyway.

I tried UML, but it has a severe shortcoming: it wasn't designed to represent the origin of member methods of a class, you can't use UML to know that class A, inherited function B, from class C that is 6 levels above in the hierarchy.

Another problem I found out, is no clear way on how to organize my structures and vtables, the existing disassembler software even when they support structures of some kind, handle nested structures poorly (ie: if you have a 10 byte structure inside a 20 byte structure, it displays the 20 byte structure as 10 bytes of its own, plus 10 opaque bytes that you need to go manually to the other structure to check what they do).

Also, I found no way to easily take notes of structure members when manually rebuilding them, the best I could come with is use a google spreadsheet with each cell being a byte (thus when I want to represent a 4byte type, I merge 4 cells... but this is clunky).


If you are using IDA Pro, it has tons of plugins and script written just for that purpose. E.g. HexRaysCodeXplorer and IDA Toolbag or in general https://www.google.com/search?q=vtable+reverse+script.

If you are not, switch to IDA Pro.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.