Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [vtables]

Mechanism used in a programming language to support run-time method binding.

3
votes
0answers
62 views

Find vtable without complete object locator

I am learning to reverse Visual C++ objects. I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its CompleteObjectLocator that I found in the ...
1
vote
1answer
72 views

Does V-Table patching (via DLL injection) only work for COM objects/classes?

Okay so not too long ago i was introduced to the concept of hooking/detouring, it took me some time to get my head around, but despite the lack of information available, eventually i was able to hook ...
2
votes
1answer
42 views

Do all class instances have a relative address/offset and can i make a copy of any class pointer?

I'm familiar with finding a player base pointer as-well as other values in games, and finding offsets and such. And I have applied that to some of my own code in the past. But does this practice ...
1
vote
1answer
354 views

How to find V-Table in IDA? (Using class informer)

I've been trying for a while now to get my head around V-Tables, V-Table patching, etc, i understand what V-Tables are and why they are used (At least i think i do). But how do i find them in IDA? I'...
1
vote
1answer
207 views

Why would a vtable reference the same function multiple times?

I decompile a VC++ application in IDA 7, and I often find vftables referencing the same function multiple times, like the one I called "Object__pure" here, part of a "heavy-base" Object class ...
0
votes
1answer
67 views

What are these extra members in this derived constructor?

In Recon 2011: Practical C++ Decompilation there is this example where some fields are assigned before the derived class' virtual table pointer is: public: __thiscall CMachine::CMachine(void) proc ...
1
vote
1answer
239 views

Why does vtable function pointers have +1?

So here is a byte sequence 45 A6 F7 in the vtable. It points to a subroutine which is located at F7A644. IDA expresses it as "function_symbol +1" Why does it plus one? Why is it 45 A6 F7 rather than ...
6
votes
2answers
805 views

How to get IDA Pro to understand a virtual function table?

I'm reversing an old DirectDraw game that uses DirectX 7. I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays: (*(int (...
5
votes
1answer
396 views

Does the order of vtable entries vary depending on the compiler?

I'm currently reversing two binaries compiled using the same exact C++ codebase. The two binaries were compiled on two different systems with different architectures: x64 on Windows and ARMv7 on ...
3
votes
1answer
400 views

vTable size calculation (for MSVC)

I made some PE analysis script. One part is virtual functions extraction, I implemented vTables lookup using this schema. Actual algorithm of lookup is not important part of question. I don't know ...
2
votes
3answers
150 views

Do I have to consider virtual function declaration order?

I loaded a shared library (I don't know the source of that) and made a header for that with IDA. Is this class Tester { public: virtual void test(); virtual void replay(); }; different ...
1
vote
2answers
578 views

Are vTable pointers always located inside a module?

Assuming the standard VC++ vTable layout: Heap-Addr TableAddr +-----------+ +-----------+ | TableAddr | ----> | Funcion-1 | ----> Exec region of module +-----------+ +---...
6
votes
1answer
4k views

How to find the location of the vtable?

Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following: The main point to realize is that whenever we declare a C++ class with virtual ...
8
votes
2answers
8k views

Converting a virtual table from .rdata into an IDA struct

Is there a way to convert a .rdata vtable entry to an IDA struct? An example of the vtable entry: And what the resulting struct should look like (but with all entries - this vtable specifically, ...
9
votes
1answer
3k views

Filling C++ interface method names in the disassembly in IDA

I have a C++ header with interfaces (classes with all methods pure virtual). I also have a binary which returns pointers to these interfaces. I debugged while running and received the virtual table ...
21
votes
1answer
5k views

Static analysis of C++ binaries

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...