Scags / IDA-Scripts

Some random IDA scripts I wrote
MIT License
54 stars 4 forks source link

vtable_structs: Add better vtable pseudocode #3

Closed Scags closed 11 months ago

Scags commented 11 months ago

This has been bothering me for a while so I began to research how to get this to work.

Basically, virtual function invocations, when viewed through pseudocode, currently have the following format:

this->vtbl->SomeVirtualFunction(this)

This always bothered me since both the PDB plugin and IDAClang/file header parsing do not have that and the pseudocode properly writes the invocation:

this->SomeVirtualFunction(this)

I did a lot of research and tried to parse the very difficult-to-follow PDB plugin code in the SDK to try and see if I could do this in vtable_structs.py.

Turns out, and I'm assuming that this is the case, that there is a "hack" for this where if you name the structures and structure members with the proper IDA-provided suffix and name (VTBL_SUFFIX and VTBL_MEMNAME), then IDA's engine will automatically ensure that the virtual table structure is listed as a virtual table in its type info, and the owning class/struct's type info will state that it contains a virtual table. This doesn't appear to work with virtual inheritance perhaps since I don't implement baseclass types, sadly. Might look into this in the future.

I discovered this by accident whilst trying to clean up the script's generation. Writing this PR took longer than the commit. Hurray!