Is there a nicer way to see vtable's function calls directly in the decompiler?
See original GitHub issueWhen I am dealing with a C++ binary, it’s expected that I will have to deal with vtables and that the binary will call functions by accessing the instance’s vtables. Defining the vtable doesn’t seem too difficult as I can type the data to an array of func* and it shows perfectly in the listing. I can then retype the appropriate field in the class’s structure to func** so the decompiler knows it is an array of func*.
The problem is this is the best I can get in the decompiler (this is an example I made up to illustrate my point):
(*this->vtable[6])(local_20);
Now, at least it does tell me that it is calling the 7th function in the vtable, but the problem is that I would like the decompiler to be able to infer WHICH function it is called, but it can’t because it cannot know that this field is a vtable so it won’t really change once assigned which would have been done before. I haven’t found an option to set a structure’s field as a constant that will never change so I am forced to manually check the vtable in the listing to figure out what is index 6 in the table.
The only other solution I seem to have found is to create a new structure with all the entries being there, but not only it will JUST say the function name and not show the actual reference, it will be completely separate from the class structure which is incredibly inconvenient to create for all vtables as I am dealing with hundreds of classes (my particula binary has debugging information).
My question: Is there a better way to deal with this and if there isn’t, would it be possible to fix this? It seems to be a huge inconvenience to check the table every time I see an indirect function call.
Issue Analytics
- State:
- Created 4 years ago
- Reactions:28
- Comments:27 (5 by maintainers)
Some people from the CMU have written a framework for static analysis of object-oriented code, including a tool for recovering classes and methods and a corresponding Ghidra plugin. It looks much more comprehensive than my script and should be the best way going forward.
ghidra vtable guide: http://hwreblog.com/projects/ghidra.html