Questions tagged [vtables]

Mechanism used in a programming language to support run-time method binding.

Filter by
Sorted by
Tagged with
1
vote
1answer
81 views

Analyze Arm Linux CPP binary in Ida Pro

I tried to open CPP binary with Ida. Most of the code analyze well . The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
2
votes
1answer
119 views

What is "nullsub_XXX" in vtable in IDA

When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual. But what does nullsub_XXX mean in a vtable structure?
2
votes
1answer
66 views

Comparing the static address of the vtable of a class, to the pointer to it held by the object

I know this is compiler/ABI dependent, not necessarily standardized, etc. I've always assumed, from what I've read in several places (e.g. an answer here or the example in wikipedia), that a typical ...
3
votes
3answers
360 views

Strange vtable setup in constructor disassembly

In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code: ctor_1: ldr r1, =vtable_base str r1, [r0] ;r0 always contains ...
2
votes
0answers
85 views

When virtual table is not the first element of structure?

Assuming that source code is compiled for ARMv7 architecure using clang (native shared object library for Android, Itanium ABI) what are the cases when virtual table pointer is not the first element ...
2
votes
0answers
158 views

How to return a list of vtable methods?

I'm relatively new to scripting environments in disassemblers. What I am looking for is a way to dump all of the vtable methods from a C++ disassembly in such a way that I can access them later for ...
3
votes
0answers
347 views

Find vtable without complete object locator

I am learning to reverse Visual C++ objects. I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its CompleteObjectLocator that I found in the ...
1
vote
1answer
414 views

Does V-Table patching (via DLL injection) only work for COM objects/classes?

Okay so not too long ago i was introduced to the concept of hooking/detouring, it took me some time to get my head around, but despite the lack of information available, eventually i was able to hook ...
2
votes
1answer
125 views

Do all class instances have a relative address/offset and can i make a copy of any class pointer?

I'm familiar with finding a player base pointer as-well as other values in games, and finding offsets and such. And I have applied that to some of my own code in the past. But does this practice ...
1
vote
1answer
4k views

How to find V-Table in IDA? (Using class informer)

I've been trying for a while now to get my head around V-Tables, V-Table patching, etc, i understand what V-Tables are and why they are used (At least i think i do). But how do i find them in IDA? I'...
2
votes
1answer
373 views

Why would a vtable reference the same function multiple times?

I decompile a VC++ application in IDA 7, and I often find vftables referencing the same function multiple times, like the one I called "Object__pure" here, part of a "heavy-base" Object class ...
0
votes
1answer
74 views

What are these extra members in this derived constructor?

In Recon 2011: Practical C++ Decompilation there is this example where some fields are assigned before the derived class' virtual table pointer is: public: __thiscall CMachine::CMachine(void) proc ...
21
votes
1answer
6k views

Static analysis of C++ binaries

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
1
vote
1answer
355 views

Why does vtable function pointers have +1?

So here is a byte sequence 45 A6 F7 in the vtable. It points to a subroutine which is located at F7A644. IDA expresses it as "function_symbol +1" Why does it plus one? Why is it 45 A6 F7 rather than ...
5
votes
2answers
1k views

How to get IDA Pro to understand a virtual function table?

I'm reversing an old DirectDraw game that uses DirectX 7. I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays: (*(int (...
4
votes
1answer
1k views

Does the order of vtable entries vary depending on the compiler?

I'm currently reversing two binaries compiled using the same exact C++ codebase. The two binaries were compiled on two different systems with different architectures: x64 on Windows and ARMv7 on ...
2
votes
1answer
862 views

vTable size calculation (for MSVC)

I made some PE analysis script. One part is virtual functions extraction, I implemented vTables lookup using this schema. Actual algorithm of lookup is not important part of question. I don't know ...
3
votes
3answers
294 views

Do I have to consider virtual function declaration order?

I loaded a shared library (I don't know the source of that) and made a header for that with IDA. Is this class Tester { public: virtual void test(); virtual void replay(); }; different ...
1
vote
2answers
1k views

Are vTable pointers always located inside a module?

Assuming the standard VC++ vTable layout: Heap-Addr TableAddr +-----------+ +-----------+ | TableAddr | ----> | Funcion-1 | ----> Exec region of module +-----------+ +---...
8
votes
1answer
9k views

How to find the location of the vtable?

Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following: The main point to realize is that whenever we declare a C++ class with virtual ...
9
votes
2answers
12k views

Converting a virtual table from .rdata into an IDA struct

Is there a way to convert a .rdata vtable entry to an IDA struct? An example of the vtable entry: And what the resulting struct should look like (but with all entries - this vtable specifically, ...
9
votes
1answer
3k views

Filling C++ interface method names in the disassembly in IDA

I have a C++ header with interfaces (classes with all methods pure virtual). I also have a binary which returns pointers to these interfaces. I debugged while running and received the virtual table ...