OpenRCE_Sirmabus
January 22nd, 2009, 05:19
My new IDA plug-in based on Igorsk's excellent article ("http://www.openrce.org/articles/full_view/23")and IDC scripts.
[Download] ("http://www.openrce.org/repositories/users/Sirmabus/Class_Informer10B.zip")
------------------------------------------------------------
Scans an MSVC 32bit target IDB for vftables with C++ RTTI, and MFC RTCI type data.
Places structure defs, names, labels, and comments to make more sense of class vftables ("Virtual Function Table"
and make them read
easier as an aid to reverse engineering.
Creates a list window with found vftables for browsing.
RTTI ("Run-Time Type Identification"
:
http://en.wikipedia.org/wiki/RTTI
RTCI ("Run Time Class Information"
the MFC forerunner to "RTTI":
http://msdn.microsoft.com/en-us/library/fych0hw6(VS.80).aspx
------------------------------------------------------------
Example vftable output list:
http://img518.imageshack.us/img518/7774/listshot1zj0.jpg
.
.
Example vftable info add by the plug-in:
http://img217.imageshack.us/img217/5951/vftabkeshot1ri2.jpg
.
.
https://www.openrce.org/blog/view/1344/Class_Informer_IDA_plug-in
[Download] ("http://www.openrce.org/repositories/users/Sirmabus/Class_Informer10B.zip")
------------------------------------------------------------
Scans an MSVC 32bit target IDB for vftables with C++ RTTI, and MFC RTCI type data.
Places structure defs, names, labels, and comments to make more sense of class vftables ("Virtual Function Table"

easier as an aid to reverse engineering.
Creates a list window with found vftables for browsing.
RTTI ("Run-Time Type Identification"

http://en.wikipedia.org/wiki/RTTI
RTCI ("Run Time Class Information"

http://msdn.microsoft.com/en-us/library/fych0hw6(VS.80).aspx
------------------------------------------------------------
Example vftable output list:
http://img518.imageshack.us/img518/7774/listshot1zj0.jpg
.
.
Example vftable info add by the plug-in:
http://img217.imageshack.us/img217/5951/vftabkeshot1ri2.jpg
.
.
https://www.openrce.org/blog/view/1344/Class_Informer_IDA_plug-in