1

I've been trying for a while now to get my head around V-Tables, V-Table patching, etc, i understand what V-Tables are and why they are used (At least i think i do).

But how do i find them in IDA? I'm using IDA Pro 7.0, and i created a test program with two classes.

class ClassA
{
public:
    ClassA();
    ~ClassA();
    virtual void Test();
};

And..

class ClassB : public ClassA
{
public:
    ClassB();
    ~ClassB();
    void Test() override;
};

The definition for the Test function in both cases is a simple cout to the console.

And in main.cpp

int main()
{
    ClassB* BClass = new ClassB();
    while (1)
    {
        BClass->Test();
        Sleep(1000);
    }
    delete BClass;
    return 0;
}

I was trying to follow this explanation, but it seems as if the data isn't structured the same way in his version of IDA.

After clicking on the class in the Class Informer window, i'm taken to IDA View-A, and this is what i see.

enter image description here

At this point i'm a bit lost, as i'm not really sure how to find or follow pointers in IDA.

  • I really need to figure out how to navigate the pointers, from class instance through the V-Table pointers, to the target function. It's not something i was taught in programming courses, and difficult to find straight forward information. – Michael Strobel Aug 22 '18 at 5:39
  • 1
    This tutorial from @IgorSkochinsky may help: youtu.be/efkLG8-G3J0 – Biswapriyo Aug 22 '18 at 5:43
2

What you're looking it is actually a VTable. As you know, a VTable is a table of function pointers and as you can see, at address 0x19B64 you actually see a single function address (this looks like dd offset sub_XXXX). That is actually a virtual function table of a size of one. Since you only have one virtual function in your demo class. That offset points to one implementation of Test. Double-clicking the function name (which defaults to the function's address prefixed with sub_ to indicate it is a subroutine) will set the cursor it it's address (and make it visible).

Somewhat below that, at address 0x19B8C, you can see the second class's vtable, as you have two classes with differing functions. That offset is the second implementation of Test

  • So if there is more than one virtual function in the class, i would find them here also? – Michael Strobel Aug 22 '18 at 23:15
  • Yes. You can compile a more elaborate example and see for yourself :) You'll simply see two (or more) lines of dd offset sub_???? one following the other, at sequential addresses. – NirIzr Aug 22 '18 at 23:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.