1

What I mean is when the Hex-Rays compiler gives me something like this:

int v1;


CreateSomeInterface(&v1);

(*(int (__thiscall **)(int))(*(_DWORD *)v1 + 4))(0);

And I have a C++ header with the interface defined like this:

struct SomeInterface
{
    virtual void func1() = 0;
    virtual void func2() = 0;
} ;

And I know that the structure of the VT is pretty straightforward (it is a standard layout for all windows interfaces - all virtual functions pointers are stored sequentially in a memory location pointer by the first structure member), eg.:

At location *(void **)this:

struct _SomeInterfaceLayOut
{
        void (*func1)();
        void (*func2)();
} ;

Is there some easy straightforward way to set the type of v1? Currently if I parse the C++ header with the virtual function declarations, the created local type SomeInterface won't contain anything and also won't be available for the decompiler to apply.

For now the only solution I think I see is manually converting all virtual functions into function pointers but this seems like hell a lot of a work.

I'm interested in this because it'll allow me more easily to understand the decompiled code. Names are better then addresses, for me at least.

1
  • "There is no royal road to geometry." Apr 13, 2016 at 2:31

1 Answer 1

1

If I understand correctly, you already have the definition of your interface, so you can just create a structure with all fields having the names of the functions (or maybe even import it if your header file is simple enough), and then define the type of your variable to this structure (Edit->Set Type, or 'Y'). That way, the "v1+4" will appears as "yourStructName.func2".

6
  • You understand correctly and I have done exactly what you suggest here before. I parse the C++ header with the interface declaration but then the type created is empty and not available for the decompiler to apply. I guess that maybe is because the C header parser in IDA won't recognize virtual function.
    – rec
    Apr 11, 2016 at 17:15
  • Well first, check in the Structures tab that the structure is what you're expecting it to be (import might give strange results). Then, sometimes the decompiler has just a hard time understanding offset, but if the structure is right, it should definitely work in the dissassembly. Apr 11, 2016 at 17:25
  • So you think IDA Pro will parse structure with virtual functions just fine and be able to deduce it's internal structure?
    – rec
    Apr 11, 2016 at 17:27
  • IDA's header parser is somewhat limited. Do as Dillinur said: define a structure for your vtable, then define a pointer to the vtable in your struct, then make v1 a pointer to that struct (all by entering C style type expressions or pulling them from a little header that you write for the purpose).
    – DarthGizka
    Apr 12, 2016 at 5:17
  • @DarthGizka - Well that would be easy with something simple but imagine hundreds lines of headers (for example the Directx interface). I suppose there is easier way.
    – rec
    Apr 12, 2016 at 11:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.