Converting a virtual table from .rdata into an IDA struct

Question

Is there a way to convert a .rdata vtable entry to an IDA struct? An example of the vtable entry:

And what the resulting struct should look like (but with all entries - this vtable specifically, should have 109 vfuncs):

I would assume there's some option to give IDA an address, and vtable length, I think I am just missing it. Or maybe there's a script I don't know of, which does this?

I'm using IDA v6.1.

World of Warcraft eh? :) May I ask your name on Ownedcore? I'ld like to talk to you. — Dominik Antal, Dec 24 '13 at 20:04

score 6 · Answer 1 · edited Dec 01 '13 at 21:05

6

There is a great IDA plugin called HexRaysCodeXplorer that does automatic type reconstruction for C++ objects . It should do what you need.

edited Dec 01 '13 at 21:05

jvoisin

2,516
16
23

answered Dec 01 '13 at 12:35

jiboutin

71
3

This looks great! But unfortunately, I think I have the wrong version of IDA (I'm still on 6.1.) I probably should have mentioned, sorry. – Jarryd Le Breton Dec 01 '13 at 14:38
It is source available. Did you try building it against the 6.1 SDK? – RobotHumans Dec 01 '13 at 19:18
I didn't, it's not all that important to me at the moment. I think I'll just wait until I can get a hold of 6.5 for the official implementation as joxeankoret mentioned. – Jarryd Le Breton Dec 02 '13 at 17:04
@hbdgaf: It doesn't compile against 6.1 'cuz it uses features that are new in 6.2 - e.g. code viewer. – ivan_pozdeev Mar 18 '14 at 07:01

score 4 · Answer 2 · answered Dec 02 '13 at 08:48

4

In the next version, 6.5, it should be as easy as selecting the corresponding VTable area, right click and selecting the menu option "Create struct from data" (leak from IDA Beta testing). In the meantime, you can use this IDAPython script I use myself. I hope you'll find it helpful.

answered Dec 02 '13 at 08:48

joxeankoret

4,488
2
21
35

The "Create struct from data" command has been available for a while now - what changed in 6.5 that makes it more useful in this case? – DCoder Dec 02 '13 at 10:39
Awesome! Hopefully I can get my hands on 6.5 in the future. I don't have IDA available at the moment, but I'll definitely check out that script when I get a chance. :) – Jarryd Le Breton Dec 02 '13 at 17:06

score 0 · Answer 3 · answered Feb 13 '23 at 14:50

Answer as of IDA 7.6 (can't guarantee it's correct):

Select your whole vtable in IDA View
Click Edit -> Structs -> Create struct from selection

I don't know of a better way currently, but the problems with this approach is that function names aren't synchronized back to the struct if you rename some subroutine, and also in my case the first member's name was also wrong...

Converting a virtual table from .rdata into an IDA struct

3 Answers3

Linked