3

I am learning to reverse Visual C++ objects.

I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its CompleteObjectLocator that I found in the disassembled binary before (using a cross reference to the object's TypeDescriptor or ClassHierarchyDescriptor). The pointer to CompleteObjectLocator is the -1st field of the vtable.

However, as some classes are probably abstract in my program, they do not have CompleteObjectLocators. How do I find their vtables?

I know that the program writes the pointer to the vtable down to this in the object's constructor, however in my program the constructors are inlined in the child class constructors and there I do not see work with memory that could be the vtable of the parent.

For example:

  • ClassA inherits from ClassB (probably abstract) that inherits from ClassC that inherits from ClassD (probably abstract). I found this information in the BaseClassArray of each of the classes.
  • I am able to find vtable of ClassA and using a cross reference on it, I find its constructor
  • In the constructor of ClassA I see the program work with vtable of ClassC and vtable of ClassA (constructors are inlined, pointer to vtable of ClassC is written to a location and three instructions later it is rewritten by the pointer to vtable of ClassA)
  • I would expect to see some work with vtables of ClassB and ClassD in the constructor of ClassA as well. I would expect the pointer to vtable of ClassB to be written do the memory somewhere between the work with vtables of ClassA and ClassC, but there are only instructions that basically do nothing, only move some content from register to register.
  • Or, if the constructor of ClassA wouldn't work with vtables of ClassB and ClassD, I would expect at least calling their constructors from there, which does not happen as well.

I know I could find a vtable dynamically, because it would be the first element of this, but I do not know where (if anywhere) this of ClassB and ClassD is used. Can I find their vtables and constructors statically?

Improve this question
4
  • Don't forget that vtables might not exist for all classes as MSVC can be told not to produce a vtable by declaring a class with __declspec(notable) – Ian Cook Nov 5 '18 at 18:36
  • __declspec(novtable) that is – Ian Cook Nov 5 '18 at 18:37
  • @IanCook I see, thank you very much for the comment. Is it possible that this is not the case and the vtables exist somewhere even though I do not see them used in the constructors of the derived classes? – Topper Harley Nov 5 '18 at 22:33
  • Add some C++ code for example to understand clearly. – Biswapriyo Nov 12 '18 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.