Is there a way to convert a .rdata vtable entry to an IDA struct? An example of the vtable entry:

And what the resulting struct should look like (but with all entries - this vtable specifically, should have 109 vfuncs):

I would assume there's some option to give IDA an address, and vtable length, I think I am just missing it. Or maybe there's a script I don't know of, which does this?

I'm using IDA v6.1.

  • World of Warcraft eh? :) May I ask your name on Ownedcore? I'ld like to talk to you. Dec 24 '13 at 20:04

There is a great IDA plugin called HexRaysCodeXplorer that does automatic type reconstruction for C++ objects . It should do what you need.

  • This looks great! But unfortunately, I think I have the wrong version of IDA (I'm still on 6.1.) I probably should have mentioned, sorry. Dec 1 '13 at 14:38
  • It is source available. Did you try building it against the 6.1 SDK? Dec 1 '13 at 19:18
  • I didn't, it's not all that important to me at the moment. I think I'll just wait until I can get a hold of 6.5 for the official implementation as joxeankoret mentioned. Dec 2 '13 at 17:04
  • @hbdgaf: It doesn't compile against 6.1 'cuz it uses features that are new in 6.2 - e.g. code viewer. Mar 18 '14 at 7:01

In the next version, 6.5, it should be as easy as selecting the corresponding VTable area, right click and selecting the menu option "Create struct from data" (leak from IDA Beta testing). In the meantime, you can use this IDAPython script I use myself. I hope you'll find it helpful.

  • The "Create struct from data" command has been available for a while now - what changed in 6.5 that makes it more useful in this case?
    – DCoder
    Dec 2 '13 at 10:39
  • Awesome! Hopefully I can get my hands on 6.5 in the future. I don't have IDA available at the moment, but I'll definitely check out that script when I get a chance. :) Dec 2 '13 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.