Vector35 / binaryninja-api

Public API, examples, documentation and issues for Binary Ninja
https://binary.ninja/
MIT License
934 stars 212 forks source link

MSVC RTTI created VFT's not typed as a named type #6158

Closed emesare closed 2 hours ago

emesare commented 3 hours ago

When MSVC RTTI creates a virtual function table it will be typed to the structure not the named type, this was originally the case (it being typed to a NTR) but at some point it changed to allow for PDB information.

You can repro this by opening a binary with RTTI (any windows binary basically) and then:

  1. Navigating to a VFT
  2. Hitting the Make Pointer key bind (default to o)
  3. Notice that the type is now not typed with a structure name
  4. Notice the user type with the name of the data var
emesare commented 3 hours ago

Fixed with https://github.com/Vector35/binaryninja-api/commit/43870ac3825272c917420b9063d068d9683675dd