get-vtable-address

Name: get-vtable-address
Author: HLND2T

58stars10forks

How to install get-vtable-address?

hlnd2t/cs2_vibesignatures/get-vtable-address

$npx -y skills add HLND2T/CS2_VibeSignatures --skill get-vtable-address

Installs into the current project.

Summary

Find a function's vtable address using IDA Pro MCP. Use this skill when want to get exact virtual address of a class. Triggers: get vftable address, get virtual function table, find vtable, get vtable

Files · 1

View on GitHub

SKILL.md

1	# Get VTable address and size
2
3	Find a class's virtual function table by class name. Get its address and size in a single step.
4
5	## Prerequisites
6
7	- ClassName
8
9	## Method
10
11	### 1. Get vtable address and size
12
13	Run this single Python script using `mcp__ida-pro-mcp__py_eval`, replacing `<CLASS_NAME>` with the actual class name (e.g., `CGameRules`, `CCSPlayer_ItemServices`):
14
15	```python
16	mcp__ida-pro-mcp__py_eval code="""
17	import ida_bytes, ida_name, idaapi, idautils, ida_segment
18
19	class_name = "<CLASS_NAME>"
20	ptr_size = 8 if idaapi.inf_is_64bit() else 4
21
22	vtable_start = None # address of first vfunc pointer
23	vtable_symbol = ""
24	is_linux = False
25	method = ""
26
27	# ── Direct symbol lookup ──────────────────────────────────────────────
28	# Windows: ??_7ClassName@@6B@
29	win_name = f"??_7{class_name}@@6B@"
30	addr = ida_name.get_name_ea(idaapi.BADADDR, win_name)
31	if addr != idaapi.BADADDR:
32	vtable_start = addr
33	vtable_symbol = win_name
34	is_linux = False
35	method = "direct"
36
37	# Linux: _ZTV<len>ClassName (e.g. _ZTV10CGameRules)
38	if vtable_start is None:
39	linux_name = f"_ZTV{len(class_name)}{class_name}"
40	addr = ida_name.get_name_ea(idaapi.BADADDR, linux_name)
41	if addr != idaapi.BADADDR:
42	vtable_start = addr + 0x10 # skip offset-to-top + typeinfo ptr
43	vtable_symbol = f"{linux_name} + 0x10"
44	is_linux = True
45	method = "direct"
46
47	# ── RTTI / TypeInfo fallback ──────────────────────────────────────────
48	# Windows: ??_R4ClassName@@6B@ (Complete Object Locator)
49	if vtable_start is None:
50	col_name = f"??_R4{class_name}@@6B@"
51	col_addr = ida_name.get_name_ea(idaapi.BADADDR, col_name)
52	if col_addr != idaapi.BADADDR:
53	is_linux = False
54	rdata_seg = ida_segment.get_segm_by_name(".rdata")
55	for ref in idautils.DataRefsTo(col_addr):
56	if rdata_seg and not (rdata_seg.start_ea <= ref < rdata_seg.end_ea):
57	continue
58	vtable_start = ref + ptr_size
59	sym = ida_name.get_name(vtable_start) or f"??_7{class_name}@@6B@"
60	vtable_symbol = sym
61	method = "rtti_fallback"
62	break
63
64	# Linux: _ZTI<len>ClassName (typeinfo)
65	if vtable_start is None:
66	ti_name = f"_ZTI{len(class_name)}{class_name}"
67	ti_addr = ida_name.get_name_ea(idaapi.BADADDR, ti_name)
68	if ti_addr != idaapi.BADADDR:
69	is_linux = True
70	for ref in idautils.DataRefsTo(ti_addr):
71	ott = ida_bytes.get_qword(ref - ptr_size) if ptr_size == 8 else ida_bytes.get_dword(ref - ptr_size)
72	if ott == 0:
73	vtable_start = ref + ptr_size
74	ztv_addr = ref - ptr_size
75	ztv_name = ida_name.get_name(ztv_addr) or f"_ZTV{len(class_name)}{class_name}"
76	vtable_symbol = f"{ztv_name} + 0x10"
77	method = "rtti_fallback"
78	break
79
80	assert vtable_start is not None, f"Cannot find vtable for {class_name}"
81
82	# ── Count virtual functions ───────────────────────────────────────────
83	count = 0
84	for i in range(1000):
85	ea = vtable_start + i * ptr_size
86
87	# Linux: stop at next vtable / typeinfo symbol boundary
88	if is_linux and i > 0:
89	name = ida_name.get_name(ea)
90	if name and (name.startswith("_ZTV") or name.startswith("_ZTI")):
91	break
92
93	ptr_value = ida_bytes.get_qword(ea) if ptr_size == 8 else ida_bytes.get_dword(ea)
94
95	if ptr_value == 0:
96	if is_linux:
97	count += 1 # NULL = pure virtual placeholder
98	continue
99	else:
100	break # Windows: NULL = vtable end
101
102	if ptr_value == 0xFFFFFFFFFFFFFFFF:
103	break
104
105	func = idaapi.get_func(ptr_value)
106	if func is not None:
107	count += 1
108	continue
109
110	flags = ida_bytes.get_full_flags(ptr_value)
111	if ida_bytes.is_code(flags):
112	count += 1
113	continue
114
115	break # not a valid function pointer
116
117	size_in_bytes = count * ptr_size
118
119	print(f"vtable_class: {class_name}")
120	print(f"vtable_symbol: {vtable_symbol}")
121	print(f"vtable_va: {hex(vtable_start)}")
122	print(f"vtable_size: {hex(size_in_bytes)}")
123	print(f"vtable_numvfuncs: {count}")
124	print(f"method: {method}")
125	"""
126	```
127
128	Lookup order:
129	1. Direct symbol: `??_7ClassName@@6B@` (Win) / `_ZTV<len>ClassName` (Linux)
130	2. RTTI fallback: `??_R4ClassName@@6B@` → DataRefsTo → vtable (Win) / `_ZTI<len>ClassName` → DataRefsTo with offset-to-top==0 → vtable (Linux)
131
132	Platform-specific vfunc counting:
133	- Linux (`_ZTV` prefix): NULL entries = pure virtual placeholders (keep counting); stops at next `_ZTV`/`_ZTI` symbol
134	- Windows (`??_7` prefix): NULL = vtable end; stops immediately
135
136	### 2. Continue with Unfinished Tasks
137
138	If we are called by a task from a task list / parent SKILL, restore and continue with the unfinished tasks.

People who liked this also viewed

6 picks

Type

get-vtable-address

58stars10forks

View on GitHub

How to install get-vtable-address?

hlnd2t/cs2_vibesignatures/get-vtable-address

$npx -y skills add HLND2T/CS2_VibeSignatures --skill get-vtable-address

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Get VTable address and size
2
3	Find a class's virtual function table by class name. Get its address and size in a single step.
4
5	## Prerequisites
6
7	- ClassName
8
9	## Method
10
11	### 1. Get vtable address and size
12
13	Run this single Python script using `mcp__ida-pro-mcp__py_eval`, replacing `<CLASS_NAME>` with the actual class name (e.g., `CGameRules`, `CCSPlayer_ItemServices`):
14
15	```python
16	mcp__ida-pro-mcp__py_eval code="""
17	import ida_bytes, ida_name, idaapi, idautils, ida_segment
18
19	class_name = "<CLASS_NAME>"
20	ptr_size = 8 if idaapi.inf_is_64bit() else 4
21
22	vtable_start = None # address of first vfunc pointer
23	vtable_symbol = ""
24	is_linux = False
25	method = ""
26
27	# ── Direct symbol lookup ──────────────────────────────────────────────
28	# Windows: ??_7ClassName@@6B@
29	win_name = f"??_7{class_name}@@6B@"
30	addr = ida_name.get_name_ea(idaapi.BADADDR, win_name)
31	if addr != idaapi.BADADDR:
32	vtable_start = addr
33	vtable_symbol = win_name
34	is_linux = False
35	method = "direct"
36
37	# Linux: _ZTV<len>ClassName (e.g. _ZTV10CGameRules)
38	if vtable_start is None:
39	linux_name = f"_ZTV{len(class_name)}{class_name}"
40	addr = ida_name.get_name_ea(idaapi.BADADDR, linux_name)
41	if addr != idaapi.BADADDR:
42	vtable_start = addr + 0x10 # skip offset-to-top + typeinfo ptr
43	vtable_symbol = f"{linux_name} + 0x10"
44	is_linux = True
45	method = "direct"
46
47	# ── RTTI / TypeInfo fallback ──────────────────────────────────────────
48	# Windows: ??_R4ClassName@@6B@ (Complete Object Locator)
49	if vtable_start is None:
50	col_name = f"??_R4{class_name}@@6B@"
51	col_addr = ida_name.get_name_ea(idaapi.BADADDR, col_name)
52	if col_addr != idaapi.BADADDR:
53	is_linux = False
54	rdata_seg = ida_segment.get_segm_by_name(".rdata")
55	for ref in idautils.DataRefsTo(col_addr):
56	if rdata_seg and not (rdata_seg.start_ea <= ref < rdata_seg.end_ea):
57	continue
58	vtable_start = ref + ptr_size
59	sym = ida_name.get_name(vtable_start) or f"??_7{class_name}@@6B@"
60	vtable_symbol = sym
61	method = "rtti_fallback"
62	break
63
64	# Linux: _ZTI<len>ClassName (typeinfo)
65	if vtable_start is None:
66	ti_name = f"_ZTI{len(class_name)}{class_name}"
67	ti_addr = ida_name.get_name_ea(idaapi.BADADDR, ti_name)
68	if ti_addr != idaapi.BADADDR:
69	is_linux = True
70	for ref in idautils.DataRefsTo(ti_addr):
71	ott = ida_bytes.get_qword(ref - ptr_size) if ptr_size == 8 else ida_bytes.get_dword(ref - ptr_size)
72	if ott == 0:
73	vtable_start = ref + ptr_size
74	ztv_addr = ref - ptr_size
75	ztv_name = ida_name.get_name(ztv_addr) or f"_ZTV{len(class_name)}{class_name}"
76	vtable_symbol = f"{ztv_name} + 0x10"
77	method = "rtti_fallback"
78	break
79
80	assert vtable_start is not None, f"Cannot find vtable for {class_name}"
81
82	# ── Count virtual functions ───────────────────────────────────────────
83	count = 0
84	for i in range(1000):
85	ea = vtable_start + i * ptr_size
86
87	# Linux: stop at next vtable / typeinfo symbol boundary
88	if is_linux and i > 0:
89	name = ida_name.get_name(ea)
90	if name and (name.startswith("_ZTV") or name.startswith("_ZTI")):
91	break
92
93	ptr_value = ida_bytes.get_qword(ea) if ptr_size == 8 else ida_bytes.get_dword(ea)
94
95	if ptr_value == 0:
96	if is_linux:
97	count += 1 # NULL = pure virtual placeholder
98	continue
99	else:
100	break # Windows: NULL = vtable end
101
102	if ptr_value == 0xFFFFFFFFFFFFFFFF:
103	break
104
105	func = idaapi.get_func(ptr_value)
106	if func is not None:
107	count += 1
108	continue
109
110	flags = ida_bytes.get_full_flags(ptr_value)
111	if ida_bytes.is_code(flags):
112	count += 1
113	continue
114
115	break # not a valid function pointer
116
117	size_in_bytes = count * ptr_size
118
119	print(f"vtable_class: {class_name}")
120	print(f"vtable_symbol: {vtable_symbol}")
121	print(f"vtable_va: {hex(vtable_start)}")
122	print(f"vtable_size: {hex(size_in_bytes)}")
123	print(f"vtable_numvfuncs: {count}")
124	print(f"method: {method}")
125	"""
126	```
127
128	Lookup order:
129	1. Direct symbol: `??_7ClassName@@6B@` (Win) / `_ZTV<len>ClassName` (Linux)
130	2. RTTI fallback: `??_R4ClassName@@6B@` → DataRefsTo → vtable (Win) / `_ZTI<len>ClassName` → DataRefsTo with offset-to-top==0 → vtable (Linux)
131
132	Platform-specific vfunc counting:
133	- Linux (`_ZTV` prefix): NULL entries = pure virtual placeholders (keep counting); stops at next `_ZTV`/`_ZTI` symbol
134	- Windows (`??_7` prefix): NULL = vtable end; stops immediately
135
136	### 2. Continue with Unfinished Tasks
137
138	If we are called by a task from a task list / parent SKILL, restore and continue with the unfinished tasks.

People who liked this also viewed

6 picks

Type