9

I have a C++ header with interfaces (classes with all methods pure virtual). I also have a binary which returns pointers to these interfaces. I debugged while running and received the virtual table addresses for these interfaces' implementation.

Is there a way to tell IDA Pro that the vtable is at a certain address, and to give it the header files and to let it mark all the methods in the vtable and name them accordingly? There are many interfaces and a lot of methods.

I saw this: Static analysis of C++ binaries, but it doesn't answer the question of automatic naming.

I'm using the freeware version 5.0.

  • 1
    There are IDC scripts and plugins for RTTI and vtable handling on IDA Palace and other sites (OpenRCE). – 0xC0000022L Aug 4 '13 at 23:32
  • @0xC0000022L OpenRCE seems to be down – heinrich5991 Aug 5 '13 at 11:57
  • @heinrich5991: Oh, so Pedram actually took it down. Will contact him. – 0xC0000022L Aug 5 '13 at 12:41
  • @heinrich5991 IDA Scripts on OpenRCE: openrce.org/downloads/browse/IDA_Scripts – PSS Aug 7 '13 at 14:06
  • @0xC0000022L Are there plugins for generic (i. e. manual) vtable handling? – heinrich5991 Aug 7 '13 at 14:21
9

If the binary itself has RTTI info compiled in it then you can get at least the names for the vftables, and to some degree a class/struct hierarchy. For Windows x86 you can use my IDA plug-in "Class Informer". Also see for reference Reversing Microsoft Visual C++ Part II: Classes, Methods and RTTI by igorsk.

Otherwise AFAIK (and know the area well) I doubt there is a plug-in that exists to do what you want. While structures exist in IDA, C++ classes don't. C++ is not part of IDA's world directly. That's more in the realm of a particular language, one of many, while IDA is about assembly and byte code domains; with the exception of the HexRays decompiler plug-in, which sort of adds a C/C++ thing on top.

Are you sure you can relate the actual binary address to a given C++ method, and, or vftable et al?

At any rate you will probably have to write your own plug-in, and, or scripts to do what you want.

  • 1
    Your website appears to be down. – crush Mar 5 '14 at 4:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.