7
votes
Accepted
IDA does not create Vtbl structs for child classes loaded from PDB
As far as I know, everything you've said is 100% correct. I've experienced the same issues. In fact, I was working on this exact problem in the background when a friend sent me a link to this post.
...
- 9,088
6
votes
What is a non-virtual thunk?
The answer should really state what the difference is between a virtual thunk and a non virtual thunk. They are identical in operation but just have a different name. The thunk for a virtually ...
- 285
3
votes
Accepted
IDA makes an incorrect guess about how a virtual function affects the stack. How can I correct/override it?
You can use Alt-K shortcut to fix the stack pointer.
Its documentation is here.
- 8,343
2
votes
ARMCC/C++ Empty Vtable entries
Two possibilities come to mind:
These are slots for pure virtual methods. In many implementations the compiler provides something like __purecall or __cxa_pure_virtual to catch accidental calls, but ...
- 36.2k
2
votes
How to get IDA Pro to understand a virtual function table?
HexRays doesn't call it because it doesn't know what is the value of g_lpDDSBack->QueryInterface in the common case.
Generally speaking you can define a structure as a QueryInterface type, where ...
- 8,343
2
votes
Accepted
Why this ASM represents Virtual Function call?
an indirect call , use of ecx as the this pointer etc indicates it is a virtual function call
lets take the example you quoted in your query modify it a little and see the disassembly
contents of ...
- 16.2k
1
vote
Accepted
Can a MSVC class have a deletion destructor without a vftable?
Apparently I was confused over the articles wording due to initially seeing deletion destructors as virtual destructors. I analyzed a small scratchpad program and realized the following:
Deletion ...
- 1,073
1
vote
Why this ASM represents Virtual Function call?
There’s no 100% sure way to distinguish a virtual call from a function pointer call but there are some strong hints.
The virtual function table (vftable) is usually at the very start of the object so ...
- 36.2k
1
vote
Debugging and profiling directx 9 calls?
I've used IDA for this, it has ability to load VTBL structures and apply them to the assembler code. So, I could see "call [IDirect3DSurface9.LockRect]" instead of "call dword ptr [edx + 0x64]"
- 1,830
1
vote
Any easy way to decompile virtual function instances?
If I understand correctly, you already have the definition of your interface, so you can just create a structure with all fields having the names of the functions (or maybe even import it if your ...
- 565
Only top scored, non community-wiki answers of a minimum length are eligible