Skip to main content

Questions tagged [vtables]

Mechanism used in a programming language to support run-time method binding.

Filter by
Sorted by
Tagged with
23 votes
1 answer
6k views

Static analysis of C++ binaries

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
user1354557's user avatar
  • 1,234
10 votes
3 answers
14k views

Converting a virtual table from .rdata into an IDA struct

Is there a way to convert a .rdata vtable entry to an IDA struct? An example of the vtable entry: And what the resulting struct should look like (but with all entries - this vtable specifically, ...
Jarryd Le Breton's user avatar
10 votes
1 answer
4k views

Filling C++ interface method names in the disassembly in IDA

I have a C++ header with interfaces (classes with all methods pure virtual). I also have a binary which returns pointers to these interfaces. I debugged while running and received the virtual table ...
Asaf's user avatar
  • 201
9 votes
1 answer
11k views

How to find the location of the vtable?

Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following: The main point to realize is that whenever we declare a C++ class with virtual ...
Dirk's user avatar
  • 443
5 votes
2 answers
2k views

How to get IDA Pro to understand a virtual function table?

I'm reversing an old DirectDraw game that uses DirectX 7. I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays: (*(int (...
user16729's user avatar
5 votes
0 answers
297 views

Cannot find references to functions in vtables

First time doing RE work and I am working on a rather large C++ binary. In Ghidra, there are many functions that do not appear to have any meaningful references to them (unlike some functions where ...
micheal65536's user avatar
4 votes
1 answer
1k views

Does the order of vtable entries vary depending on the compiler?

I'm currently reversing two binaries compiled using the same exact C++ codebase. The two binaries were compiled on two different systems with different architectures: x64 on Windows and ARMv7 on ...
jocopa3's user avatar
  • 143
3 votes
3 answers
636 views

Strange vtable setup in constructor disassembly

In a program I'm trying to recover data structures I've discovered the following strange (ARM) disassembly code: ctor_1: ldr r1, =vtable_base str r1, [r0] ;r0 always contains ...
Overblade's user avatar
3 votes
1 answer
482 views

What is "nullsub_XXX" in vtable in IDA

When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual. But what does nullsub_XXX mean in a vtable structure?
vtable's user avatar
  • 183
3 votes
1 answer
452 views

Why would a vtable reference the same function multiple times?

I decompile a VC++ application in IDA 7, and I often find vftables referencing the same function multiple times, like the one I called "Object__pure" here, part of a "heavy-base" Object class ...
Ray's user avatar
  • 1,103
3 votes
1 answer
326 views

Do all class instances have a relative address/offset and can i make a copy of any class pointer?

I'm familiar with finding a player base pointer as-well as other values in games, and finding offsets and such. And I have applied that to some of my own code in the past. But does this practice ...
Michael Strobel's user avatar
3 votes
3 answers
394 views

Do I have to consider virtual function declaration order?

I loaded a shared library (I don't know the source of that) and made a header for that with IDA. Is this class Tester { public: virtual void test(); virtual void replay(); }; different ...
user160368's user avatar
3 votes
0 answers
568 views

Find vtable without complete object locator

I am learning to reverse Visual C++ objects. I usually find the vtable (or VMT of VFT, however you call it) of the object using a cross reference to its CompleteObjectLocator that I found in the ...
Topper Harley's user avatar
3 votes
0 answers
230 views

How can I parse VMTs in IDA if I have the base address?

I have run the Class Informer plugin to identify virtual method tables. I am trying to write a python script which will rename each function in the table. I am struggling to find the correct API ...
question_asker_777's user avatar
2 votes
1 answer
463 views

Why does vtable function pointers have +1?

So here is a byte sequence 45 A6 F7 in the vtable. It points to a subroutine which is located at F7A644. IDA expresses it as "function_symbol +1" Why does it plus one? Why is it 45 A6 F7 rather than ...
ManDongI's user avatar
2 votes
1 answer
188 views

Reversing C++ Classes in ARM

I have unstripped linux arm binary, The code calls functions in class object reference like so: LDR R3, [R6] MOV R1, R7 MOV R0, R6 LDR R3, [R3,#0xC] ; (...
Dinamo's user avatar
  • 21
2 votes
1 answer
413 views

Comparing the static address of the vtable of a class, to the pointer to it held by the object

I know this is compiler/ABI dependent, not necessarily standardized, etc. I've always assumed, from what I've read in several places (e.g. an answer here or the example in wikipedia), that a typical ...
Alejandro Exojo's user avatar
2 votes
1 answer
1k views

vTable size calculation (for MSVC)

I made some PE analysis script. One part is virtual functions extraction, I implemented vTables lookup using this schema. Actual algorithm of lookup is not important part of question. I don't know ...
ST3's user avatar
  • 849
2 votes
0 answers
92 views

When virtual table is not the first element of structure?

Assuming that source code is compiled for ARMv7 architecure using clang (native shared object library for Android, Itanium ABI) what are the cases when virtual table pointer is not the first element ...
Artyom Sokolov's user avatar
2 votes
0 answers
296 views

How to return a list of vtable methods?

I'm relatively new to scripting environments in disassemblers. What I am looking for is a way to dump all of the vtable methods from a C++ disassembly in such a way that I can access them later for ...
MrSynAckSter's user avatar
  • 1,258
1 vote
2 answers
1k views

Are vTable pointers always located inside a module?

Assuming the standard VC++ vTable layout: Heap-Addr TableAddr +-----------+ +-----------+ | TableAddr | ----> | Funcion-1 | ----> Exec region of module +-----------+ +---...
Dave's user avatar
  • 153
1 vote
1 answer
703 views

Does V-Table patching (via DLL injection) only work for COM objects/classes?

Okay so not too long ago i was introduced to the concept of hooking/detouring, it took me some time to get my head around, but despite the lack of information available, eventually i was able to hook ...
Michael Strobel's user avatar
1 vote
1 answer
7k views

How to find V-Table in IDA? (Using class informer)

I've been trying for a while now to get my head around V-Tables, V-Table patching, etc, i understand what V-Tables are and why they are used (At least i think i do). But how do i find them in IDA? I'...
Michael Strobel's user avatar
1 vote
1 answer
478 views

Analyze Arm Linux CPP binary in Ida Pro

I tried to open CPP binary with Ida. Most of the code analyze well . The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
yfr24493AzzrggAcom's user avatar
0 votes
2 answers
207 views

How does IDA know the symbol names for classes and interfaces?

I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
trxgnyp1's user avatar
  • 103
0 votes
1 answer
131 views

Decompilers points to non-existing virtual function

As part of solving the Hidden password challenge, I found an condition calls a virtual function the v14 points to v8 variable : and the functions in the program does not make sense for me, there is ...
IVs's user avatar
  • 137
0 votes
1 answer
74 views

What are these extra members in this derived constructor?

In Recon 2011: Practical C++ Decompilation there is this example where some fields are assigned before the derived class' virtual table pointer is: public: __thiscall CMachine::CMachine(void) proc ...
Ci3's user avatar
  • 105