Advertisement
GaztoofV2

IDA VMT Dumper Script

May 7th, 2021
2,377
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 2.21 KB | None | 0 0
  1. #include <idc.idc>
  2.  
  3. static main()
  4. {
  5. auto pAddress, iIndex;
  6. auto szFilePath, hFile;
  7. auto skipAmt;
  8.  
  9. SetStatus(IDA_STATUS_WORK);
  10.  
  11. // User selected vtable block
  12. pAddress = ScreenEA();
  13.  
  14. if (pAddress == BADADDR)
  15. {
  16. Message("** No vtable selected! Aborted **");
  17. Warning("No vtable selected!\nSelect vtable block first.");
  18. SetStatus(IDA_STATUS_READY);
  19. return;
  20. }
  21.  
  22. skipAmt = AskLong(1, "Number of vtable entries to ignore for indexing:");
  23.  
  24. // Request output header file
  25. SetStatus(IDA_STATUS_WAITING);
  26. if ((szFilePath = AskFile(1, "*.txt", "Select output dump file:")) == 0)
  27. {
  28. Message("Aborted.");
  29. SetStatus(IDA_STATUS_READY);
  30. return;
  31. }
  32.  
  33. // And create it..
  34. if ((hFile = fopen(szFilePath, "wb")) != 0)
  35. {
  36. auto szFuncName, szFullName, BadHits;
  37.  
  38. BadHits = 0;
  39.  
  40. /* For linux, skip the first entry */
  41. if (Dword(pAddress) == 0)
  42. {
  43. pAddress = pAddress + 4;
  44. }
  45.  
  46. pAddress = pAddress + (skipAmt * 4);
  47.  
  48. // Create the header
  49. auto className = Demangle(Name(Dword(pAddress)), INF_SHORT_DN);
  50. fprintf(hFile, "// Auto reconstructed from vtable block @ 0x%08X\n// from \"%s\", by ida_vtables.idc\n// Modified VTable dumper script obviously by t.me/Gaztoof.\nclass %s\n{\npublic:\n//Don't forget the constructor.\n", pAddress, GetInputFile(), className);
  51.  
  52. // Loop through the vtable block
  53. while (pAddress != BADADDR)
  54. {
  55. auto real_addr;
  56. real_addr = Dword(pAddress);
  57.  
  58. szFuncName = Name(real_addr);
  59. if (strlen(szFuncName) == 0)
  60. {
  61. break;
  62. }
  63.  
  64. szFullName = demangle_name(szFuncName, 0);
  65.  
  66. if (trim(szFullName) == "")
  67. {
  68. szFullName = szFuncName;
  69. }
  70. if (strstr(szFullName, "_ZN") != -1)
  71. {
  72. fclose(hFile);
  73. Warning("You must toggle GCC v3.x demangled names!\n");
  74. break;
  75. }
  76.  
  77. fprintf(hFile, "/*%d*/\tvirtual void* %s = 0;\n", iIndex, szFullName);
  78.  
  79. pAddress = pAddress + 4;
  80. iIndex++;
  81. };
  82.  
  83. fprintf(hFile, "};");
  84. fclose(hFile);
  85. Message("Successfully wrote %d vtable entries.\n", iIndex);
  86. }
  87. else
  88. {
  89. Message("** Error opening \"%s\"! Aborted **\n", szFilePath);
  90. Warning("Error creating \"%s\"!\n", szFilePath);
  91. }
  92.  
  93. Message("\nDone.\n\n");
  94. SetStatus(IDA_STATUS_READY);
  95. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement