Tool
Virtuailor
IDAPython tool that reconstructs C++ virtual tables in IDA Pro for 32- and 64-bit Intel and AArch64 code by observing indirect calls while the program runs under IDA's debugger. Its static part finds indirect calls and hooks the assignment of their targets with conditional breakpoints; when those breakpoints hit, the dynamic part creates vtable structures, renames vtables and virtual functions, adds structure offsets to the call instructions and cross-references from each indirect call to the virtual functions it reached, and for AArch64 firmware tries to fix undefined vtables and their functions.
- Targets
- Binary · Firmware
- Category
- Debugging and dynamic analysis
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: IDA Pro 7.0 to 7.5: the master branch targets 7.5, and IDA versions older than 7.4 need the beforeIDA-7.4 branch. Run Main.py through File > Run script, ideally after taking an IDB snapshot as the README recommends, then exercise the program under IDA's debugger; AArch64 targets can be debugged through a remote GDB server. The repository has no releases; the reviewed master commit dates from 2020-06-06.
- Limits: Only vtables used by virtual calls that are hit at run time are reconstructed, and the README says some breakpoints may be missed.
- License: GPL-3.0 per LICENSE.
About this entry
The description was reviewed against primary sources.
Primary sources
More in Native binaries
- xAnalyzer · Tool
- Voltron · Tool
- Remill · Tool
- iaito · Tool
- HexRaysCodeXplorer · Tool
- GDB dashboard · Tool