Topic created on: July 20, 2006 14:29 CDT by Sirmabus .

I cranked out this quick script today to reconstruct a vtable dump in IDA back into a useful class definition.



It works particularly well in this example because most of the functions are defined and thus have pretty names, it could at least be used as a starting point for creating the vtable then RE'ing the method(s) of interest.

To be used in an injected DLL, etc., where you can get the THIS for the object(s) you want and then cast it using these reconstructed  classes. And yes they don't have class data, you still have to RE that.

You can download the script from http://openrce.org/downloads/details/223/VTableRec

Some other idea's are changing the output format to create just indexes as an enum or #defines where one can make an asm stub to call the methods from straight C, etc.

Developed on 4.7 but should work on any version.

-Sirmabus