📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Questions about Vtable

Topic created on: January 14, 2009 03:14 CST by mostneed .

my target is compiled by g++, i get this ClassA, its construct method is like:

ClassA::ClassA(void)
public _ZN4ClassAC1Ev
_ZN4ClassAC1Ev    proc near               ; CODE XREF: main+18Ep

push    ebp
mov     ebp, esp
push    edi
push    esi
push    ebx
sub     esp, 7Ch        ; Integer Subtraction
mov     esi, [ebp+arg_0] ; arg_0=this

...

mov     dword ptr [esi], 936FFE8h
mov     dword ptr [esi+8], 9370020h
mov     dword ptr [esi+0Ch], 937003Ch
mov     dword ptr [esi+10h], 9370054h
mov     dword ptr [esi+28h], 9370068h
mov     dword ptr [esi+104h], 937007Ch
mov     dword ptr [esi+120h], 9370094h
mov     dword ptr [esi+128h], 93700A8h
--------------------------------------------------

And Vtable is like,

`vtable for'ClassA
.rodata:0936FFE0 _ZTV4ClassA       dd 0
.rodata:0936FFE4                 dd offset _ZTI4ClassA     ; `typeinfo for'ClassA
.rodata:0936FFE8                 dd offset _ZN4ClassAD1Ev  ; ClassA::~ClassA()
.rodata:0936FFEC                 dd offset _ZN4ClassAD0Ev  ; ClassA::~ClassA()
.rodata:0936FFF0                 dd 85DF53Eh
.rodata:0936FFF4                 dd offset _ZN4ClassA10Foo1EN4Init15checkPoint_typeE ; ClassA::Foo1(Init::checkPoint_type)
.rodata:0936FFF8                 dd offset _ZN4ClassA13HandlerEi ; ClassA::Handler(int)
.rodata:0936FFFC                 dd offset _ZN4ClassA8DispatchE9EventTypeiibiiPv ; ClassA::Dispatch(EventType,int,int,bool,int,int,void *)
.rodata:09370000                 dd offset _ZN10ClassB6Foo8Ej ; ClassB::Foo8(uint)
.rodata:09370004                 dd offset _ZNK4ClassA7Foo5Ev ; ClassA::Foo5(void)
.rodata:09370008                 dd 85CDF24h
.rodata:0937000C                 dd offset _ZN4ClassA9Foo6ER8Msg ; ClassA::Foo6(Msg &)
.rodata:09370010                 dd offset _ZNK4ClassA18Foo2Ev ; ClassA::Foo2(void)
.rodata:09370014                 dd offset _ZNK4ClassA18Foo3Ev ; ClassA::Foo3(void)
.rodata:09370018                 dd 0FFFFFFF8h
.rodata:0937001C                 dd offset _ZTI4ClassA     ; `typeinfo for'ClassA
.rodata:09370020                 dd offset _ZThn8_N4ClassAD1Ev ; `non-virtual thunk to'ClassA::~ClassA()
.rodata:09370024                 dd offset _ZThn8_N4ClassAD0Ev ; `non-virtual thunk to'ClassA::~ClassA()
.rodata:09370028                 dd offset _ZThn8_N10ClassB6Foo8Ej ; `non-virtual thunk to'ClassB::Foo8(uint)
.rodata:0937002C                 dd offset _ZN7Factory14Foo4Ev ; Factory::Foo4(void)
.rodata:09370030                 dd offset _ZN7Factory17Foo7Ev ; Factory::Foo7(void)
.rodata:09370034                 dd 0FFFFFFF4h
.rodata:09370038                 dd offset _ZTI4ClassA     ; `typeinfo for'ClassA
.rodata:0937003C                 dd offset _ZThn12_N4ClassAD1Ev ; `non-virtual thunk to'ClassA::~ClassA()
.rodata:09370040                 dd offset _ZThn12_N4ClassAD0Ev ; `non-virtual thunk to'ClassA::~ClassA()
.rodata:09370044                 dd offset _ZThn12_N4ClassA10Foo1EN4Init15_typeE ; `non-virtual thunk to'ClassA::Foo1(Init::type)
.rodata:09370048                 dd offset _ZN4Init18ReadyForFoo1ENS_15_typeE ; Init::ReadyForFoo1(Init::_type)
.rodata:0937004C                 dd 0FFFFFFF0h
.rodata:09370050                 dd offset _ZTI4ClassA     ; `typeinfo for'ClassA
.rodata:09370054                 dd offset _ZThn16_N4ClassAD1Ev ; `non-virtual thunk to'ClassA::~ClassA()
.rodata:09370058                 dd offset _ZThn16_N4ClassAD0Ev ; `non-virtual thunk to'ClassA::~ClassA()
.rodata:0937005C                 dd offset _ZThn16_NK4ClassA7Foo5Ev ; `non-virtual thunk to'ClassA::Foo5(void)
.rodata:09370060                 dd 0FFFFFFD8h
...


why there's more than one vtab there, and two destruct method for each class? i really confuse about it, anybody will help? thanks a lot!

  igorsk     January 15, 2009 11:21.30 CST
Check this:
http://www.codesourcery.com/public/cxx-abi/abi.html
You need section 2.5, Virtual Table Layout.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit