Converting a virtual table from .rdata into an IDA struct

Question

Is there a way to convert a .rdata vtable entry to an IDA struct? An example of the vtable entry:

And what the resulting struct should look like (but with all entries - this vtable specifically, should have 109 vfuncs):

I would assume there's some option to give IDA an address, and vtable length, I think I am just missing it. Or maybe there's a script I don't know of, which does this?

I'm using IDA v6.1.

Answer 1

There is a great IDA plugin called HexRaysCodeXplorer that does automatic type reconstruction for C++ objects . It should do what you need.

Answer 2

In the next version, 6.5, it should be as easy as selecting the corresponding VTable area, right click and selecting the menu option "Create struct from data" (leak from IDA Beta testing). In the meantime, you can use this IDAPython script I use myself. I hope you'll find it helpful.

Answer 3

Answer as of IDA 7.6 (can't guarantee it's correct):

1. Select your whole vtable in IDA View
2. Click Edit -> Structs -> Create struct from selection

I don't know of a better way currently, but the problems with this approach is that function names aren't synchronized back to the struct if you rename some subroutine, and also in my case the first member's name was also wrong...