I've been trying for a while now to get my head around V-Tables, V-Table patching, etc, i understand what V-Tables are and why they are used (At least i think i do).

But how do i find them in IDA? I'm using IDA Pro 7.0, and i created a test program with two classes.

class ClassA
    virtual void Test();


class ClassB : public ClassA
    void Test() override;

The definition for the Test function in both cases is a simple cout to the console.

And in main.cpp

int main()
    ClassB* BClass = new ClassB();
    while (1)
    delete BClass;
    return 0;

I was trying to follow this explanation, but it seems as if the data isn't structured the same way in his version of IDA.

After clicking on the class in the Class Informer window, i'm taken to IDA View-A, and this is what i see.

enter image description here

At this point i'm a bit lost, as i'm not really sure how to find or follow pointers in IDA.

  • I really need to figure out how to navigate the pointers, from class instance through the V-Table pointers, to the target function. It's not something i was taught in programming courses, and difficult to find straight forward information. Aug 22, 2018 at 5:39
  • 1
    This tutorial from @IgorSkochinsky may help: youtu.be/efkLG8-G3J0
    – Biswapriyo
    Aug 22, 2018 at 5:43

1 Answer 1


What you're looking it is actually a VTable. As you know, a VTable is a table of function pointers and as you can see, at address 0x19B64 you actually see a single function address (this looks like dd offset sub_XXXX). That is actually a virtual function table of a size of one. Since you only have one virtual function in your demo class. That offset points to one implementation of Test. Double-clicking the function name (which defaults to the function's address prefixed with sub_ to indicate it is a subroutine) will set the cursor it it's address (and make it visible).

Somewhat below that, at address 0x19B8C, you can see the second class's vtable, as you have two classes with differing functions. That offset is the second implementation of Test

  • So if there is more than one virtual function in the class, i would find them here also? Aug 22, 2018 at 23:15
  • Yes. You can compile a more elaborate example and see for yourself :) You'll simply see two (or more) lines of dd offset sub_???? one following the other, at sequential addresses.
    – NirIzr
    Aug 22, 2018 at 23:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.