1

What I mean is when the Hex-Rays compiler gives me something like this:

int v1;


CreateSomeInterface(&v1);

(*(int (__thiscall **)(int))(*(_DWORD *)v1 + 4))(0);

And I have a C++ header with the interface defined like this:

struct SomeInterface
{
    virtual void func1() = 0;
    virtual void func2() = 0;
} ;

And I know that the structure of the VT is pretty straightforward (it is a standard layout for all windows interfaces - all virtual functions pointers are stored sequentially in a memory location pointer by the first structure member), eg.:

At location *(void **)this:

struct _SomeInterfaceLayOut
{
        void (*func1)();
        void (*func2)();
} ;

Is there some easy straightforward way to set the type of v1? Currently if I parse the C++ header with the virtual function declarations, the created local type SomeInterface won't contain anything and also won't be available for the decompiler to apply.

For now the only solution I think I see is manually converting all virtual functions into function pointers but this seems like hell a lot of a work.

I'm interested in this because it'll allow me more easily to understand the decompiled code. Names are better then addresses, for me at least.

  • "There is no royal road to geometry." – Vitaly Osipov Apr 13 '16 at 2:31
1

If I understand correctly, you already have the definition of your interface, so you can just create a structure with all fields having the names of the functions (or maybe even import it if your header file is simple enough), and then define the type of your variable to this structure (Edit->Set Type, or 'Y'). That way, the "v1+4" will appears as "yourStructName.func2".

  • You understand correctly and I have done exactly what you suggest here before. I parse the C++ header with the interface declaration but then the type created is empty and not available for the decompiler to apply. I guess that maybe is because the C header parser in IDA won't recognize virtual function. – rec Apr 11 '16 at 17:15
  • Well first, check in the Structures tab that the structure is what you're expecting it to be (import might give strange results). Then, sometimes the decompiler has just a hard time understanding offset, but if the structure is right, it should definitely work in the dissassembly. – Dillinur Apr 11 '16 at 17:25
  • So you think IDA Pro will parse structure with virtual functions just fine and be able to deduce it's internal structure? – rec Apr 11 '16 at 17:27
  • IDA's header parser is somewhat limited. Do as Dillinur said: define a structure for your vtable, then define a pointer to the vtable in your struct, then make v1 a pointer to that struct (all by entering C style type expressions or pulling them from a little header that you write for the purpose). – DarthGizka Apr 12 '16 at 5:17
  • @DarthGizka - Well that would be easy with something simple but imagine hundreds lines of headers (for example the Directx interface). I suppose there is easier way. – rec Apr 12 '16 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.