Just to clarify, I'm talking about vbtables (virtual base tables) not vftables (virtual function tables). vbtables are how the compiler implements virtual inheritance, here is an excellent summary from @IgorSkochinsky (pp. 6-8) https://www.hexblog.com/wp-content/uploads/2011/08/Recon-2011-Skochinsky.pdf …
-
-
Prikaži ovu nit
-
It was pointed out to me privately that you can mark the offset as a offset into the vftable ('t' in Hex-Rays), then you can get this->http://base.data [this->base.__vbtable->SubClass1_idx] + offsetof(SubClass1_vtbl, MethodName))(...). It's a *little* easier to read.
Prikaži ovu nit -
The lesson seems to be that you should use virtual inheritance in your DRM scheme or malware, because basically no reversers will know how to analyze the virtual base tables
Prikaži ovu nit
Kraj razgovora
Novi razgovor -
-
-
Unfortunately our decompiler does have special support for virtual inheritance. We will implement it one day but not ETA yet
-
Thanks Ilfak. It's pretty impressive with some union tricks you can still make something readable, even without special support!
Kraj razgovora
Novi razgovor -
-
-
have you tried hiding the casts?

- Kraj razgovora
Novi razgovor -
-
-
Maybe some HR plugin to detect and transform to more simple construct? I've seen similar things done in HR plugins by others, haven't written it myself tho.
-
I think it might be the only way. Might be an interesting project, I've only written IDA plugins, never a Hex-Rays one!
Kraj razgovora
Novi razgovor -
-
-
Yes. Step 1: Highlight the entire vtable in linear view and right click. Select "create struct" or "make struct" or whatever it's called
-
Step 2: Rename the resulting struct type "MyClass_vtbl"
- Još 8 drugih odgovora
Novi razgovor -
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.
