question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Is there a nicer way to see vtable's function calls directly in the decompiler?

See original GitHub issue

When I am dealing with a C++ binary, it’s expected that I will have to deal with vtables and that the binary will call functions by accessing the instance’s vtables. Defining the vtable doesn’t seem too difficult as I can type the data to an array of func* and it shows perfectly in the listing. I can then retype the appropriate field in the class’s structure to func** so the decompiler knows it is an array of func*.

The problem is this is the best I can get in the decompiler (this is an example I made up to illustrate my point):

(*this->vtable[6])(local_20);

Now, at least it does tell me that it is calling the 7th function in the vtable, but the problem is that I would like the decompiler to be able to infer WHICH function it is called, but it can’t because it cannot know that this field is a vtable so it won’t really change once assigned which would have been done before. I haven’t found an option to set a structure’s field as a constant that will never change so I am forced to manually check the vtable in the listing to figure out what is index 6 in the table.

The only other solution I seem to have found is to create a new structure with all the entries being there, but not only it will JUST say the function name and not show the actual reference, it will be completely separate from the class structure which is incredibly inconvenient to create for all vtables as I am dealing with hundreds of classes (my particula binary has debugging information).

My question: Is there a better way to deal with this and if there isn’t, would it be possible to fix this? It seems to be a huge inconvenience to check the table every time I see an indirect function call.

Issue Analytics

  • State:open
  • Created 4 years ago
  • Reactions:28
  • Comments:27 (5 by maintainers)

github_iconTop GitHub Comments

5reactions
dvdkoncommented, Sep 25, 2019

Some people from the CMU have written a framework for static analysis of object-oriented code, including a tool for recovering classes and methods and a corresponding Ghidra plugin. It looks much more comprehensive than my script and should be the best way going forward.

5reactions
mattypipercommented, Jun 26, 2019
Read more comments on GitHub >

github_iconTop Results From Across the Web

Ghidra -- A quick start guide with pictures and a C++ example
Checking back with the decompiler view we can see everything looks much nicer. Next let's work on setting up the VTable function calls....
Read more >
Fast Virtual Functions: Hacking the VTable for Fun and Profit
We've seen how you can call virtual functions directly, now let's see why you might want to. Virtual functions are slow when you...
Read more >
Reversing Basic C++ Objects with Ghidra - YouTube
In this video we'll take a look at several sample programs that use ... how it's used by the object and explore the...
Read more >
How to get IDA Pro to understand a virtual function table?
HexRays doesn't call it because it doesn't know what is the value of g_lpDDSBack->QueryInterface in the common case.
Read more >
Reversing C++, Qt based applications using Ghidra
If you want to know in detail how the ABI for the C++ language works, ... i.e., it tells the compiler to resolve...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found