vtable

Tool tools/pe/vtable.py (program, Windows PE). List the slots of a table of function pointers (a C++ vtable) with the functions they hold.

Run it with ./gameframe run vtable ARGS or python3 tools/pe/vtable.py. Source on GitHub.

Its own help

This is the help text in the tool itself, as ./gameframe tool vtable prints it.

List the slots of a table of function pointers (a C++ vtable) with the functions they hold.

Usage: vtable.py BINARY TABLE_ADDRESS [SLOTS] [--names functions.tsv]

Reads pointers from TABLE_ADDRESS until one does not point into an executable section (or
SLOTS are read), and prints each slot's offset, target and name. Names come from a Ghidra
functions.tsv (scripts/ghidra-export.sh writes one) and from labels/names.tsv when present.
A class's vtable is found in its constructor: the first store into a new object is usually
`*this = &vtable`. Slot offsets are what call sites use: `(*(code **)(*obj + 0x18))(obj)` calls
slot +0x18.

Named by

Skills: re-ghidra.