2

I'm analyzing a C++ PE binary with its debug symbols using IDA 7.3 w/ the decompiler.

I'm using the HexRaysPyTools plugin to get the xrefs to class fields, but it doesn't show xrefs to virtual functions.

I want to know if there is an existing similar plugin that can build the xref list for calls to virtual functions statically (ie. without running the code).

As far as I can understand the behavior of HexRaysPyTools, it should be trivial to do that as the IDA decompiler already recognize virtual function calls when decompiling, I just need it to store the xref list to virtual functions just as HexRaysPyTools does with member fields.

1
  • im not going to start a new topic as this one is perfectly related to my question and is reletively new. i am searching for good vtable/RTTI tools. i came across the ida_medigate (mentioned above) but i cant get it working. anyone can help me with it?
    – shetal
    Sep 1 at 2:27
3

In fact this is not as “trivial” as one might think.

However there was a plug-in submitted to this year’s plug-in contest that might work:

https://www.hex-rays.com/contests_details/contest2020/#ida_medigate

https://github.com/medigate-io/ida_medigate

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.