1

I tried to open CPP binary with Ida. Most of the code analyze well .

The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (offset) so Ida will analyze the functions that all the fields in vtable point on them.

In addition,the first function in Vtable is constructor ,and in that constructor we can see the vtable that this vtable inherits from. Ida didn't analyze the "father" vtable.

How can I fix this/or is there a script that do it as well to CPP Aem binary

2
  • do you need to find virtual functions or build class hierarchy?
    – R4444
    Nov 19, 2021 at 22:05
  • @R4444 both of them. But 1 of those will be good :) Nov 20, 2021 at 16:47

1 Answer 1

1

as you mentioned in comments, you need to build class hierarchy or find vtables. Following are some projects that I know will help you in achieving what you would like.

  1. classinformer - https://sourceforge.net/projects/classinformer/

  2. Classy - https://github.com/RicBent/Classy

  3. Hexpytools - https://github.com/igogo-x86/HexRaysPyTools

  4. Also look @ this exellent publication, but their code base is not open sourced - https://dl.acm.org/doi/pdf/10.1145/3321705.3329833 (last time I asked them, they told me that they are planning to do so shortly)

Their paper is interesting to look at, as it explains how to recover such structures. Typically, you need, vtable entries, vtable structures, class constructor and destructor analysis and object flow analysis to build the desired hierarchy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.