How can I follow virtual function calls in IDA?

Question

I'm trying to reverse a video game that was made with the CryEngine 5 game engine. CryEngine 5 source code is available on GitHub, so I can look at the CryEngine source code and cross reference with the game in IDA to find a lot of information.

Here is a snippet of code from the CryEngine source code:

As you can see, there is a class called ISystem, and it has a virtual method GetIPhysicalWorld which is being called. I have found the same virtual function call in IDA within the specific game that I'm trying to reverse:

My question is: in IDA, how can I find the address of the virtual function that is being called (GetIPhysicalWorld)? Also, how can I find the vtable of the ISystem class in IDA?

Answer 1

How can I find the address of the virtual function that is being called (GetIPhysicalWorld)?

I guess you want to do that statically? If so, you first need to identify how the object was allocated to find the call of the constructor. In this case, since there's a g_ prefix, I assume this is a global object. The constructor is called by _initterm and `dynamic initializer for ...', you can find it using the xref. You should see something like this (it could be located inside a sub function):

lea rcx, <vtable>
mov [obj], rcx

And a call to atexit.

Once you have the vtable, simply do the math. :)

Also, how can I find the vtable of the ISystem class in IDA?

You can try to use class informer plugin. It'll give you the name of the class and its virtual methods. However, you won't have the name of methods since this information is lost during compilation(, unless you have symbols). Since you have the source, you can also try to generate code signature (FLIRT or Rizzo) to retrieve the names.

If you want to rename the offset during the call, this is a different problem. You have to create a new structure. I don't think IDA support parsing of C++ class, you can either transform the C++ class to a C structure or script it.