How can I parse VMTs in IDA if I have the base address?

Asked Jun 21 '15 at 12:55

Active Dec 15 '22 at 08:38

Viewed 228 times

I have run the Class Informer plugin to identify virtual method tables. I am trying to write a python script which will rename each function in the table. I am struggling to find the correct API call to change an .rdata subroutine name. I have read through this guide, but I'm still confused: http://www.offensivecomputing.net/papers/IDAPythonIntro.pdf

e.g., if I have this vmt for ExampleClassA:

.rdata:004F0EE8     ??_7?$ExampleClassA@$@@@ dd offset sub_25DFAD
.rdata:004F0EE8                                             ; DATA XREF: sub_256CB0+98
.rdata:004F0EE8                                             ; CNetChan____45+86 ...
.rdata:004F0EEC                     dd offset sub_3B0760
.rdata:004F0EF0                     dd offset sub_1A2080
....

I want to enter the base address ( 0x004F0EE8 ) and iterate over the table to rename each subroutine based on a user-supplied name. I can iterate, get input, move ea.

How do I modify the subroutine name of the current line?

edited Dec 15 '22 at 08:38

asked Jun 21 '15 at 12:55

question_asker_777

See Setting name of (newly created) functions via IDAPython – Jason Geffner Jun 21 '15 at 14:23
1

Also, Igor Skochinsky already wrote IDC scripts for that particular task (http://www.openrce.org/downloads/details/196), it could be helpful. – Spl3en Jun 22 '15 at 11:53

How can I parse VMTs in IDA if I have the base address?

0 Answers0