Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [virtual-functions]

In Object-Oriented Programming, a virtual function is initially defined in a base class, and can be redefined in derived classes, so that when a virtual function is invoked, the function defined in the receiver's class is executed.

2
votes
1answer
86 views

IDA does not create Vtbl structs for child classes loaded from PDB

I'm decompiling a MFC 4.0 application, and now loaded the MFCS42.PDB from the MFC 4.2 source into IDA 7.0 (not having the MFC 4.0 source) to make it create the appropriate structs representing the ...
3
votes
0answers
54 views

Find vtable without complete object locator

I am learning to reverse Visual C++ objects. I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its CompleteObjectLocator that I found in the ...
2
votes
1answer
128 views

IDA makes an incorrect guess about how a virtual function affects the stack. How can I correct/override it?

So this may be a weird question. I'm working with a windows 32-bit executable in IDA that was originally programmed in C/C++ (Mostly likely with Visual Studio .NET 2002). For the virtual function ...
3
votes
1answer
72 views

Debugging and profiling directx 9 calls?

Lets say I'm debugging a game which I don't have the src code. This game was built with directx 9 and I want to dig into the more low-level stuff around it. I already did some hooks in some dx9 calls ...
4
votes
1answer
120 views

ARMCC/C++ Empty Vtable entries

I am reversing an application for the 3ds which are compiled with ARMCC. I found the vtables of the key classes and have a problem figuring out how the C++ representation of these was. Vtable of ...
1
vote
0answers
65 views

Understanding IE11's Ineterprocess Communication via COM

I'm quite new to COM object reversing (Windows Platform). I'm trying to reverse Internet Explorer on Windows 8.1, where child IE process communicates with Parent IE process via com (Due to Protected ...
6
votes
2answers
763 views

How to get IDA Pro to understand a virtual function table?

I'm reversing an old DirectDraw game that uses DirectX 7. I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays: (*(int (...
1
vote
1answer
566 views

Any easy way to decompile virtual function instances?

What I mean is when the Hex-Rays compiler gives me something like this: int v1; CreateSomeInterface(&v1); (*(int (__thiscall **)(int))(*(_DWORD *)v1 + 4))(0); And I have a C++ header with the ...
3
votes
1answer
10k views

What is a non-virtual thunk?

In real code I have encountered some "non-virtual thunk" functions: ; `non-virtual thunk to'QTextCodecPlugin::create(QString const&) EXPORT _ZThn8_N16QTextCodecPlugin6createERK7QString ...
4
votes
2answers
3k views

Where the pointer to virtual function table is located?

I used to think that the pointer to the Virtual Function Table (VFT, also Virtual Method Table, VMT) is the very first 32-bit word of the object binary representation. But now I see a VFT whose index ...
5
votes
1answer
1k views

Why two virtual destructors?

The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as: _ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, ...
2
votes
2answers
438 views

What is stored in the virtual function table? (Android NDK, GNU C++)

I see that the virtual method table (VMT, a.k.a. VFT) contains some odd values, e.g.: obj:0x123c1a8 [704] vmt:0x611f77f8 data: 0123c1a8 f8 77 1f 61 00 96 23 01 00 00 00 00 c4 e0 b4 5c 00 00 00 00 00 ...
8
votes
1answer
9k views

How to identify function calls in IDA Pro's disassembly?

I am reverse engineering some code from which IDA has generated the following disassembly. These specific lines of code are just for illustrative purposes. Notice that the third line does not call a ...
21
votes
1answer
5k views

Static analysis of C++ binaries

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...