Skip to main content
7 votes

What is a non-virtual thunk?

The answer should really state what the difference is between a virtual thunk and a non virtual thunk. They are identical in operation but just have a different name. The thunk for a virtually ...
Lewis Kelsey's user avatar
7 votes
Accepted

IDA does not create Vtbl structs for child classes loaded from PDB

As far as I know, everything you've said is 100% correct. I've experienced the same issues. In fact, I was working on this exact problem in the background when a friend sent me a link to this post. ...
Rolf Rolles's user avatar
  • 9,198
3 votes
Accepted

IDA makes an incorrect guess about how a virtual function affects the stack. How can I correct/override it?

You can use Alt-K shortcut to fix the stack pointer. Its documentation is here.
w s's user avatar
  • 8,508
2 votes

ARMCC/C++ Empty Vtable entries

Two possibilities come to mind: These are slots for pure virtual methods. In many implementations the compiler provides something like __purecall or __cxa_pure_virtual to catch accidental calls, but ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

How to get IDA Pro to understand a virtual function table?

HexRays doesn't call it because it doesn't know what is the value of g_lpDDSBack->QueryInterface in the common case. Generally speaking you can define a structure as a QueryInterface type, where ...
w s's user avatar
  • 8,508
2 votes
Accepted

Why this ASM represents Virtual Function call?

an indirect call , use of ecx as the this pointer etc indicates it is a virtual function call lets take the example you quoted in your query modify it a little and see the disassembly contents of ...
blabb's user avatar
  • 16.4k
1 vote
Accepted

Can a MSVC class have a deletion destructor without a vftable?

Apparently I was confused over the articles wording due to initially seeing deletion destructors as virtual destructors. I analyzed a small scratchpad program and realized the following: Deletion ...
Ray's user avatar
  • 1,103
1 vote

Why this ASM represents Virtual Function call?

There’s no 100% sure way to distinguish a virtual call from a function pointer call but there are some strong hints. The virtual function table (vftable) is usually at the very start of the object so ...
Igor Skochinsky's user avatar
  • 36.8k
1 vote

Debugging and profiling directx 9 calls?

I've used IDA for this, it has ability to load VTBL structures and apply them to the assembler code. So, I could see "call [IDirect3DSurface9.LockRect]" instead of "call dword ptr [edx + 0x64]"
Anton Kukoba's user avatar
  • 1,850
1 vote

Any easy way to decompile virtual function instances?

If I understand correctly, you already have the definition of your interface, so you can just create a structure with all fields having the names of the functions (or maybe even import it if your ...
user2823000's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible