Is there a way to convert a .rdata vtable entry to an IDA struct? An example of the vtable entry:

And what the resulting struct should look like (but with all entries - this vtable specifically, should have 109 vfuncs):

I would assume there's some option to give IDA an address, and vtable length, I think I am just missing it. Or maybe there's a script I don't know of, which does this?

I'm using IDA v6.1.

  • World of Warcraft eh? :) May I ask your name on Ownedcore? I'ld like to talk to you. Commented Dec 24, 2013 at 20:04

3 Answers 3


There is a great IDA plugin called HexRaysCodeXplorer that does automatic type reconstruction for C++ objects . It should do what you need.

  • This looks great! But unfortunately, I think I have the wrong version of IDA (I'm still on 6.1.) I probably should have mentioned, sorry. Commented Dec 1, 2013 at 14:38
  • It is source available. Did you try building it against the 6.1 SDK? Commented Dec 1, 2013 at 19:18
  • I didn't, it's not all that important to me at the moment. I think I'll just wait until I can get a hold of 6.5 for the official implementation as joxeankoret mentioned. Commented Dec 2, 2013 at 17:04
  • @hbdgaf: It doesn't compile against 6.1 'cuz it uses features that are new in 6.2 - e.g. code viewer. Commented Mar 18, 2014 at 7:01

In the next version, 6.5, it should be as easy as selecting the corresponding VTable area, right click and selecting the menu option "Create struct from data" (leak from IDA Beta testing). In the meantime, you can use this IDAPython script I use myself. I hope you'll find it helpful.

  • The "Create struct from data" command has been available for a while now - what changed in 6.5 that makes it more useful in this case?
    – DCoder
    Commented Dec 2, 2013 at 10:39
  • Awesome! Hopefully I can get my hands on 6.5 in the future. I don't have IDA available at the moment, but I'll definitely check out that script when I get a chance. :) Commented Dec 2, 2013 at 17:06

Answer as of IDA 7.6 (can't guarantee it's correct):

  1. Select your whole vtable in IDA View
  2. Click Edit -> Structs -> Create struct from selection

I don't know of a better way currently, but the problems with this approach is that function names aren't synchronized back to the struct if you rename some subroutine, and also in my case the first member's name was also wrong...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.