I am learning to reverse Visual C++ objects.
I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its
CompleteObjectLocator that I found in the disassembled binary before (using a cross reference to the object's
ClassHierarchyDescriptor). The pointer to
CompleteObjectLocator is the -1st field of the vtable.
However, as some classes are probably abstract in my program, they do not have
CompleteObjectLocators. How do I find their vtables?
I know that the program writes the pointer to the vtable down to
this in the object's constructor, however in my program the constructors are inlined in the child class constructors and there I do not see work with memory that could be the vtable of the parent.
ClassB(probably abstract) that inherits from
ClassCthat inherits from
ClassD(probably abstract). I found this information in the
BaseClassArrayof each of the classes.
- I am able to find vtable of
ClassAand using a cross reference on it, I find its constructor
- In the constructor of
ClassAI see the program work with vtable of
ClassCand vtable of
ClassA(constructors are inlined, pointer to vtable of
ClassCis written to a location and three instructions later it is rewritten by the pointer to vtable of
- I would expect to see some work with vtables of
ClassDin the constructor of
ClassAas well. I would expect the pointer to vtable of
ClassBto be written do the memory somewhere between the work with vtables of
ClassC, but there are only instructions that basically do nothing, only move some content from register to register.
- Or, if the constructor of
ClassAwouldn't work with vtables of
ClassD, I would expect at least calling their constructors from there, which does not happen as well.
I know I could find a vtable dynamically, because it would be the first element of
this, but I do not know where (if anywhere)
ClassD is used. Can I find their vtables and constructors statically?