10

I have a C++ header with interfaces (classes with all methods pure virtual). I also have a binary which returns pointers to these interfaces. I debugged while running and received the virtual table addresses for these interfaces' implementation.

Is there a way to tell IDA Pro that the vtable is at a certain address, and to give it the header files and to let it mark all the methods in the vtable and name them accordingly? There are many interfaces and a lot of methods.

I saw this: Static analysis of C++ binaries, but it doesn't answer the question of automatic naming.

I'm using the freeware version 5.0.

Community
  • 1
Asaf
  • 201
  • 2
  • 3

1 Answers1

9

If the binary itself has RTTI info compiled in it then you can get at least the names for the vftables, and to some degree a class/struct hierarchy. For Windows x86 you can use my IDA plug-in "Class Informer". Also see for reference Reversing Microsoft Visual C++ Part II: Classes, Methods and RTTI by igorsk.

Otherwise AFAIK (and know the area well) I doubt there is a plug-in that exists to do what you want. While structures exist in IDA, C++ classes don't. C++ is not part of IDA's world directly. That's more in the realm of a particular language, one of many, while IDA is about assembly and byte code domains; with the exception of the HexRays decompiler plug-in, which sort of adds a C/C++ thing on top.

Are you sure you can relate the actual binary address to a given C++ method, and, or vftable et al?

At any rate you will probably have to write your own plug-in, and, or scripts to do what you want.

Gilles 'SO- stop being evil'
  • 1,358
  • 13
  • 23
Sirmabus
  • 91
  • 2