vtable
Recover C++ virtual function tables from a given address: read pointer slots, classify code pointers, and optionally create structs, labels, and typed methods in Ghidra.
Instructions
Recover a C++ vtable: type the function-pointer table at address.
Point this at the start of a vtable (the address an object's vptr holds,
i.e. the first virtual-function slot — not the Itanium offset-to-top/typeinfo
prefix). It reads consecutive pointer-sized words, classifies each as a code
pointer or not (respecting the program's pointer size, endianness, and the
ARM/Thumb low bit), and reports the slots as JSON. This is discovery-by-hand:
you supply the address; it does not scan memory for vtables.
With `count` unset, slots are read until the first non-code pointer (bounded
by `max_count`). With `count` set, exactly that many slots are read.
When `apply` is true it also:
- creates a struct (`<class>_vtable` or `vtable_<address>`) of function
pointers — one named `vfuncN` field per slot, with the target function in
the field comment — and applies it at `address`;
- labels the table (as `<class>::vftable` when `class_name` is given);
- creates a function at each code slot when `create_functions` is true. A
slot whose target is not yet an instruction (stale data, or bytes left
decoded in the wrong ISA mode such as PowerPC VLE vs Book-E) is cleared
and re-disassembled in the language's correct default mode before the
function is created; slots that still can't be recovered are reported in
`unrecovered_slots` rather than silently skipped;
- when `class_name` is given and `type_methods` is true, reparents each slot
method into the class and sets its first parameter to `<class> *this`
(adding one if the method has no parameters), so the decompiler propagates
the class type. Reports `typed_methods`.
Set `apply=false` for a read-only report (always safe).
Args:
address: Start of the vtable (address or exact label).
program: Required Ghidra project path or name to target.
count: Exact number of slots to read. Omit to auto-detect by code-run.
max_count: Upper bound on slots when auto-detecting. Default 256.
apply: Create the struct/label/functions. False = report only.
create_functions: Create functions at slot targets (recovering stale or
wrong-ISA-mode targets first).
class_name: Associate the table with this class (created if missing);
the table is labeled `<class_name>::vftable`.
type_methods: When a class is given, reparent slot methods into the
class and type their `this` pointer. Default true; no-op without
`class_name`.
timeout: Bridge execution timeout in seconds.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| apply | No | ||
| count | No | ||
| address | Yes | ||
| program | Yes | ||
| timeout | No | ||
| max_count | No | ||
| class_name | No | ||
| type_methods | No | ||
| create_functions | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |