0

I'm trying to reverse a video game that was made with the CryEngine 5 game engine. CryEngine 5 source code is available on GitHub, so I can look at the CryEngine source code and cross reference with the game in IDA to find a lot of information.

Here is a snippet of code from the CryEngine source code:

enter image description here

As you can see, there is a class called ISystem, and it has a virtual method GetIPhysicalWorld which is being called. I have found the same virtual function call in IDA within the specific game that I'm trying to reverse:

enter image description here

My question is: in IDA, how can I find the address of the virtual function that is being called (GetIPhysicalWorld)? Also, how can I find the vtable of the ISystem class in IDA?

  • Try to import the header file of that class. There may be some inheritance (512/8 is big). this and this may help. – Biswapriyo Apr 22 at 14:50
1

How can I find the address of the virtual function that is being called (GetIPhysicalWorld)?

I guess you want to do that statically? If so, you first need to identify how the object was allocated to find the call of the constructor. In this case, since there's a g_ prefix, I assume this is a global object. The constructor is called by _initterm and `dynamic initializer for ...', you can find it using the xref. You should see something like this (it could be located inside a sub function):

lea rcx, <vtable>
mov [obj], rcx

And a call to atexit.

Once you have the vtable, simply do the math. :)

Also, how can I find the vtable of the ISystem class in IDA?

You can try to use class informer plugin. It'll give you the name of the class and its virtual methods. However, you won't have the name of methods since this information is lost during compilation(, unless you have symbols). Since you have the source, you can also try to generate code signature (FLIRT or Rizzo) to retrieve the names.

If you want to rename the offset during the call, this is a different problem. You have to create a new structure. I don't think IDA support parsing of C++ class, you can either transform the C++ class to a C structure or script it.

  • 1
    Class informer is no longer needed. IDA 7.x has native support for RTTI. – Avery3R Sep 19 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.