Just to clarify, I'm talking about vbtables (virtual base tables) not vftables (virtual function tables). vbtables are how the compiler implements virtual inheritance, here is an excellent summary from @IgorSkochinsky (pp. 6-8) https://www.hexblog.com/wp-content/uploads/2011/08/Recon-2011-Skochinsky.pdf …
-
-
Show this thread
-
It was pointed out to me privately that you can mark the offset as a offset into the vftable ('t' in Hex-Rays), then you can get this->http://base.data [this->base.__vbtable->SubClass1_idx] + offsetof(SubClass1_vtbl, MethodName))(...). It's a *little* easier to read.
Show this thread -
The lesson seems to be that you should use virtual inheritance in your DRM scheme or malware, because basically no reversers will know how to analyze the virtual base tables
Show this thread
End of conversation
New conversation -
-
-
Unfortunately our decompiler does have special support for virtual inheritance. We will implement it one day but not ETA yet
-
Thanks Ilfak. It's pretty impressive with some union tricks you can still make something readable, even without special support!
End of conversation
New conversation -
-
-
have you tried hiding the casts?

- End of conversation
New conversation -
-
-
Maybe some HR plugin to detect and transform to more simple construct? I've seen similar things done in HR plugins by others, haven't written it myself tho.
-
I think it might be the only way. Might be an interesting project, I've only written IDA plugins, never a Hex-Rays one!
End of conversation
New conversation -
-
-
Yes. Step 1: Highlight the entire vtable in linear view and right click. Select "create struct" or "make struct" or whatever it's called
-
Step 2: Rename the resulting struct type "MyClass_vtbl"
- 8 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
