IDA VTable Explorer
C++ 138
// Overview
Automatic vtable detection, inheritance analysis, and function override tracking for reverse engineering compiled C++ binaries. Features GCC/MSVC symbol pattern detection, class name extraction, virtual function indexing, RTTI-based inheritance hierarchy detection, and interactive visualization. Supports IDA Pro 9+ across Windows, Linux, and macOS platforms.
// Built with
C++IDA Pro SDKvtableRTTI
// The problem
Reverse-engineering a C++ binary means rebuilding class layouts by hand: locating vtables, matching each virtual function to its class, and reconstructing the inheritance tree. On a stripped binary that is hours of manual cross-referencing per class.
// Approach
- Scan the binary for vtable layouts across both GCC and MSVC, then resolve every entry to its target function.
- Recover class names and the inheritance hierarchy from RTTI when present, falling back to structural heuristics when it is stripped.
- Surface everything inside IDA: a vtable chooser, a function browser, annotated vtables and an interactive inheritance graph.
// Engineering challenges
- GCC and MSVC encode vtables and RTTI differently, so detection runs on separate paths that converge on one model.
- Telling real vtables apart from coincidental pointer arrays without flooding the output with false positives.
- Staying responsive on large binaries with thousands of virtual functions.
