Questions tagged [virtual-functions]

In Object-Oriented Programming, a virtual function is initially defined in a base class, and can be redefined in derived classes, so that when a virtual function is invoked, the function defined in the receiver's class is executed.

Filter by
Sorted by
Tagged with
0 votes
1 answer
84 views

Decompilers points to non-existing virtual function

As part of solving the Hidden password challenge, I found an condition calls a virtual function the v14 points to v8 variable : and the functions in the program does not make sense for me, there is ...
1 vote
1 answer
78 views

Can a MSVC class have a deletion destructor without a vftable?

I'm reversing the following smart pointee-like MSVC class Buffer : public Referencable with IDA / Hexrays: struct Referencable { int m_refs; }; struct Buffer : Referencable { void* m_pData; }; ...
  • 1,013
2 votes
2 answers
167 views

Why this ASM represents Virtual Function call?

I'm referring to this question that was asked previously: Virtual functions call asm I'm wondering how is it possible to know whether this ASM listing represents Virtual Functions calls? What's in the ...
0 votes
0 answers
84 views

finding a not-so-straightforward game's function

I am working on Mad Max game [ APEX engine ] I do my best to explain the situation. so my target executes function like this: there are commands like " call [eax+XX] " or " call RX &...
  • 11
3 votes
1 answer
1k views

IDA does not create Vtbl structs for child classes loaded from PDB

I'm decompiling a MFC 4.0 application, and now loaded the MFCS42.PDB from the MFC 4.2 source into IDA 7.0 (not having the MFC 4.0 source) to make it create the appropriate structs representing the ...
  • 1,013
3 votes
0 answers
450 views

Find vtable without complete object locator

I am learning to reverse Visual C++ objects. I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its CompleteObjectLocator that I found in the ...
2 votes
1 answer
379 views

IDA makes an incorrect guess about how a virtual function affects the stack. How can I correct/override it?

So this may be a weird question. I'm working with a windows 32-bit executable in IDA that was originally programmed in C/C++ (Mostly likely with Visual Studio .NET 2002). For the virtual function ...
  • 123
3 votes
1 answer
421 views

Debugging and profiling directx 9 calls?

Lets say I'm debugging a game which I don't have the src code. This game was built with directx 9 and I want to dig into the more low-level stuff around it. I already did some hooks in some dx9 calls ...
3 votes
2 answers
288 views

ARMCC/C++ Empty Vtable entries

I am reversing an application for the 3ds which are compiled with ARMCC. I found the vtables of the key classes and have a problem figuring out how the C++ representation of these was. Vtable of ...
  • 131
1 vote
0 answers
91 views

Understanding IE11's Ineterprocess Communication via COM

I'm quite new to COM object reversing (Windows Platform). I'm trying to reverse Internet Explorer on Windows 8.1, where child IE process communicates with Parent IE process via com (Due to Protected ...
  • 205
5 votes
2 answers
2k views

How to get IDA Pro to understand a virtual function table?

I'm reversing an old DirectDraw game that uses DirectX 7. I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays: (*(int (...
1 vote
1 answer
980 views

Any easy way to decompile virtual function instances?

What I mean is when the Hex-Rays compiler gives me something like this: int v1; CreateSomeInterface(&v1); (*(int (__thiscall **)(int))(*(_DWORD *)v1 + 4))(0); And I have a C++ header with the ...
  • 425
10 votes
2 answers
22k views

What is a non-virtual thunk?

In real code I have encountered some "non-virtual thunk" functions: ; `non-virtual thunk to'QTextCodecPlugin::create(QString const&) EXPORT _ZThn8_N16QTextCodecPlugin6createERK7QString ...
4 votes
2 answers
4k views

Where the pointer to virtual function table is located?

I used to think that the pointer to the Virtual Function Table (VFT, also Virtual Method Table, VMT) is the very first 32-bit word of the object binary representation. But now I see a VFT whose index ...
7 votes
1 answer
2k views

Why two virtual destructors?

The beginning of the virtual function table (VFT, also virtual method table, VMT) disasembled by IDA goes as: _ZTV13QSystemLocale DCD 0, _ZTI13QSystemLocale, _ZN13QSystemLocaleD2Ev+1, ...
2 votes
2 answers
580 views

What is stored in the virtual function table? (Android NDK, GNU C++)

I see that the virtual method table (VMT, a.k.a. VFT) contains some odd values, e.g.: obj:0x123c1a8 [704] vmt:0x611f77f8 data: 0123c1a8 f8 77 1f 61 00 96 23 01 00 00 00 00 c4 e0 b4 5c 00 00 00 00 00 ...
9 votes
1 answer
15k views

How to identify function calls in IDA Pro's disassembly?

I am reverse engineering some code from which IDA has generated the following disassembly. These specific lines of code are just for illustrative purposes. Notice that the third line does not call a ...
  • 205
22 votes
1 answer
6k views

Static analysis of C++ binaries

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
  • 1,214