Hello again, Melo here

in the past, I had another blog about reversing and programming too, but I, unfortunately, deleted it  😞 there was a post about Virtual Method Table or vTable, call how you want, that was very good, so I’ll try to make another one here,

First of all

What’s a vTable? The definition from Wikipedia is:

“A virtual method table (VMT), virtual function table, virtual call table, dispatch table, vtable, or vftable is a mechanism used in a programming language to support dynamic dispatch (or run-time method binding).” [1]

Didn’t you get yet? no problem, I’ll explain it to you step by step, maybe I’ll divide this tutorial into two parts because It can become large.

A vTable is nothing more than a table of pointers for virtual functions, then inside of vTable, there are virtual function pointers from the class that u instanciated. I’ll show y’all some example:

class Vehicle
{
public:
  Vehicle(){}
  ~Vehicle(){}
  bool is_on;
  virtual void turn_on(){}
  virtual void turn_off(){}

  void make_sound()
  {
    printf("Vruuuuuuuum!");
  }
};

then we created a simple vehicle class, right? I’ll instantiate a simple vehicle right now.

Vehicle* v1 = new Vehicle();

v1->make_sound();

I placed a breakpoint at the class constructor, and make_sound function, then on GDBGUI you’ll see the Vehicle constructor address and the entry-point address (main).

when you instantiate the Vehicle class it’ll create an object for us as we’re using the new operator, it’ll return to us an address for we point to the object instance.

As you can see there’s a pointer to object instance, containing a member called is_on of bool type with a false value.

Ok, guys, that’s it for today, it’s the basis of the basic, in the next article I’ll show y’all where’s vTable, how to find it (spoiler: vtbl_ptr), I hope that u liked this article and it could help you to understand better, It’ll be step by step, then keep calm and never give up.