Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I made some PE analysis script. One part is virtual functions extraction, I implemented vTables lookup using this schema.
Actual algorithm of lookup is not important part of question. I don't know how to determine actual size of vTable, that I get is pointer to COL, pointer to 1st virtual method, pointer to 2nd virtual method, ... pointer to last virtual method.
So the problem is that I don't know which virtual method is the last. Any help related to this is appreciate.
You could try the following heuristic: extend the vtable from its given base address until you reach an address that has already been classified as something else (e.g. the COL pointer of the next vtable) or you find something that is not the address of a known function in a known code segment. This analysis step should be deferred until after the full web of RTTI descriptors and its associated structures has been found and verified.
This works if the functions can be identified with certainty or at least reasonable accuracy via other means (like debug info, map files, or the function descriptor tables that are mandatory for 64-bit executables); it does not work quite so well if the point of analysing the vtables is to find more code addresses.
I found the performance of this heuristic quite satisfactory in a couple of real-world analysis projects, like with one humongous game executable that contained some 23000 vtables.
function descriptor tables that are mandatory for 64-bit executables, started googling function descriptor tables but it doesn't give anything valuable, is it correct name for that?