2

I made some PE analysis script. One part is virtual functions extraction, I implemented vTables lookup using this schema.

Actual algorithm of lookup is not important part of question. I don't know how to determine actual size of vTable, that I get is pointer to COL, pointer to 1st virtual method, pointer to 2nd virtual method, ... pointer to last virtual method.

So the problem is that I don't know which virtual method is the last. Any help related to this is appreciate.

2

You could try the following heuristic: extend the vtable from its given base address until you reach an address that has already been classified as something else (e.g. the COL pointer of the next vtable) or you find something that is not the address of a known function in a known code segment. This analysis step should be deferred until after the full web of RTTI descriptors and its associated structures has been found and verified.

This works if the functions can be identified with certainty or at least reasonable accuracy via other means (like debug info, map files, or the function descriptor tables that are mandatory for 64-bit executables); it does not work quite so well if the point of analysing the vtables is to find more code addresses.

I found the performance of this heuristic quite satisfactory in a couple of real-world analysis projects, like with one humongous game executable that contained some 23000 vtables.

4
  • I've been thinking about your suggested heuristic, probably will try this if don't find anything better.
    – ST3
    Apr 12 '16 at 13:47
  • You said function descriptor tables that are mandatory for 64-bit executables, started googling function descriptor tables but it doesn't give anything valuable, is it correct name for that?
    – ST3
    Apr 27 '16 at 8:22
  • The magic names are '.pdata section' (in the PE COFF spec) and RUNTIME_FUNCTION on MSDN.
    – DarthGizka
    Apr 27 '16 at 8:28
  • That works perfect for me in current situation, thanks!
    – ST3
    Apr 27 '16 at 9:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.