Hot answers tagged

10 votes
Accepted

How to find the location of the vtable?

This is compiler dependent - the compiler may place the vtable wherever it wants to, as long as it does it consistently. However, in most cases, the vtable pointer is the first element (at offset 0) ...
user avatar
8 votes
Accepted

Why does vtable function pointers have +1?

If it is ARM architecture that may use THUMB encoding it can be result of the following issue: If I remember correctly, calls to the virtual functions can be executed with assembly command similar to ...
user avatar
  • 7,875
7 votes
Accepted

Are vTable pointers always located inside a module?

Note that not every C++ compiler neccesarily uses a vtable pointer at all. For example, the Watcom C++ compiler, 20 years ago, implemented method calls by reserving a function pointer for each method ...
user avatar
6 votes
Accepted

What is "nullsub_XXX" in vtable in IDA

Welcome to the Reverse engineering stack exchange Q&A site! Although you only asked about nullsub_, you described ___cxa_pure_virtual slightly incorrectly so I'll describe it as well nullsub_X IDA ...
user avatar
  • 11.4k
4 votes
Accepted

Strange vtable setup in constructor disassembly

You're correctly interpreting C++'s way of implementing class inheritance, however your assumption that the "subobject" is a member object of the class may be incorrect. Through compiled code alone, ...
user avatar
  • 11.4k
3 votes
Accepted

Comparing the static address of the vtable of a class, to the pointer to it held by the object

The Itanium C++ ABI is sometimes not very clear about what exactly is “vtable”. In practice, the symbol such as _ZTV12DerivedClass points to the complete vtable structure, which includes the two ...
user avatar
  • 34.9k
3 votes

Strange vtable setup in constructor disassembly

Could it be multiple inheritance? That could explain why the vptr of the supposed subobject is overwritten by ctor_2 without having to assume the compiler to inline anything. The derived class might ...
user avatar
  • 31
3 votes

Does V-Table patching (via DLL injection) only work for COM objects/classes?

You are absolutely on the right track But, A* a = new A(); ... a->doThing() Is not going to bother with the vtable at all. Because a can only be of A type. MSVC will still create the vftable, ...
user avatar
  • 664
3 votes
Accepted

How to find V-Table in IDA? (Using class informer)

What you're looking it is actually a VTable. As you know, a VTable is a table of function pointers and as you can see, at address 0x19B64 you actually see a single function address (this looks like dd ...
user avatar
  • 11.4k
2 votes
Accepted

Why would a vtable reference the same function multiple times?

As I guessed and was confirmed in the comments, this is apparently some compiler optimization reusing methods executing the same logic. This got clear to me when I reversed the methods of one of the ...
user avatar
  • 993
2 votes

How to get IDA Pro to understand a virtual function table?

HexRays doesn't call it because it doesn't know what is the value of g_lpDDSBack->QueryInterface in the common case. Generally speaking you can define a structure as a QueryInterface type, where ...
user avatar
  • 7,875
2 votes
Accepted

Does the order of vtable entries vary depending on the compiler?

In General, with modern operating systems, the order won't depend on the compiler, but it may depend on the operating system. Any modern operating system does not just define the operating system API,...
user avatar
2 votes

vTable size calculation (for MSVC)

You could try the following heuristic: extend the vtable from its given base address until you reach an address that has already been classified as something else (e.g. the COL pointer of the next ...
user avatar
  • 1,960
2 votes
Accepted

Do I have to consider virtual function declaration order?

The order of virtual functions is significant; altering the order in the source code will alter the order in the generated machine code. In your example, the two source samples will generate different ...
user avatar
2 votes

Are vTable pointers always located inside a module?

I believe that it is possible for both the vtable pointer to point to a different module, and for functions pointers in the vtable to point to a different module (at least indirectly.) The first ...
user avatar
  • 2,229
2 votes
Accepted

Do all class instances have a relative address/offset and can i make a copy of any class pointer?

I'll start with a few minor corrections and clarifications, just to make sure we're using the right terms and exact definitions. I used Cheat engine to find the address of the variable i in A::...
user avatar
  • 11.4k
1 vote

Analyze Arm Linux CPP binary in Ida Pro

as you mentioned in comments, you need to build class hierarchy or find vtables. Following are some projects that I know will help you in achieving what you would like. classinformer - https://...
user avatar
  • 1,447
1 vote

Strange vtable setup in constructor disassembly

You have here multiple inheritance where both base classes have virtual destructors. The pattern you see in dtor_derived_so is a so-called "non-virtual thunk", which adjusts this before calling the ...
user avatar
  • 34.9k

Only top scored, non community-wiki answers of a minimum length are eligible