Any easy way to decompile virtual function instances?

Question

What I mean is when the Hex-Rays compiler gives me something like this:

int v1;


CreateSomeInterface(&v1);

(*(int (__thiscall **)(int))(*(_DWORD *)v1 + 4))(0);

And I have a C++ header with the interface defined like this:

struct SomeInterface
{
    virtual void func1() = 0;
    virtual void func2() = 0;
} ;

And I know that the structure of the VT is pretty straightforward (it is a standard layout for all windows interfaces - all virtual functions pointers are stored sequentially in a memory location pointer by the first structure member), eg.:

At location *(void **)this:

struct _SomeInterfaceLayOut
{
        void (*func1)();
        void (*func2)();
} ;

Is there some easy straightforward way to set the type of v1? Currently if I parse the C++ header with the virtual function declarations, the created local type SomeInterface won't contain anything and also won't be available for the decompiler to apply.

For now the only solution I think I see is manually converting all virtual functions into function pointers but this seems like hell a lot of a work.

I'm interested in this because it'll allow me more easily to understand the decompiled code. Names are better then addresses, for me at least.

Answer 1

If I understand correctly, you already have the definition of your interface, so you can just create a structure with all fields having the names of the functions (or maybe even import it if your header file is simple enough), and then define the type of your variable to this structure (Edit->Set Type, or 'Y'). That way, the "v1+4" will appears as "yourStructName.func2".