summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMason Reed <mason@vector35.com>2025-03-19 21:13:33 -0400
committerMason Reed <mason@vector35.com>2025-03-19 21:17:34 -0400
commit2e4472e2ed9e3db2058bf546e0da414f3a7e43db (patch)
treeb3cf3134a026df50acfc6d8e17ebc484dbb27bf1
parent7a2f7a0526ad8bc444f04f7256fe67b9f2abc6cc (diff)
Update RTTI README.md
-rw-r--r--plugins/rtti/README.md102
1 files changed, 26 insertions, 76 deletions
diff --git a/plugins/rtti/README.md b/plugins/rtti/README.md
index ef95222d..3f0d4bdd 100644
--- a/plugins/rtti/README.md
+++ b/plugins/rtti/README.md
@@ -1,86 +1,36 @@
-# MSVC RTTI
+# C++ RTTI
-Parses and symbolizes MSVC RTTI information in [Binary Ninja].
-
-## Example Complete Object Locator
-
-This analysis can be triggered with the `MSVC\\Find RTTI` command.
-
-```cpp
-struct _RTTICompleteObjectLocator MapTrackView::`RTTI Complete Object Locator'{for `QPaintDevice'} =
-{
- enum signature = COL_SIG_REV1
- uint32_t offset = 0x10
- uint32_t cdOffset = 0x0
- void* __based(start) pTypeDescriptor = class MapTrackView `RTTI Type Descriptor' {__dos_header + 0x2071e8}
- struct _RTTIClassHierarchyDescriptor* __based(start) pClassHierarchyDescriptor = MapTrackView::`RTTI Class Hierarchy Descriptor' {__dos_header + 0x1c6128}
- void* __based(start) pSelf = MapTrackView::`RTTI Complete Object Locator'{for `QPaintDevice'} {__dos_header + 0x1c61a0}
-}
-```
-
-_The above listing includes type information deduced separately through demangled names_
-
-## Example Virtual Function Table Listing
-
-This analysis can be triggered with the `MSVC\\Find VFTs` command.
-
-```cpp
-void* data_14013bfd8 = MapTrackView::`RTTI Complete Object Locator'{for `QPaintDevice'}
-struct QPaintDevice::MapTrackView::VTable MapTrackView::`vftable'{for `QPaintDevice'} =
-{
- int64_t (* const vFunc_0)(int64_t arg1, char arg2, int512_t arg3) = sub_140053114
- int32_t (* const vFunc_1)(QWidget* this) = Qt5Widgets:QWidget::devType(QWidget* this) const__ptr64
- class QPaintEngine* __ptr64 (* const vFunc_2)(QWidget* this) = Qt5Widgets:QWidget::paintEngine(QWidget* this) const__ptr64
- int32_t (* const vFunc_3)(QWidget* this, enum QPaintDevice::PaintDeviceMetric arg2) = Qt5Widgets:QWidget::metric(QWidget* this, enum QPaintDevice::PaintDeviceMetric) const__ptr64
- void (* const vFunc_4)(QWidget* this, class QPainter* __ptr64 arg2) = Qt5Widgets:QWidget::initPainter(QWidget* this, class QPainter* __ptr64) const__ptr64
- class QPaintDevice* __ptr64 (* const vFunc_5)(QWidget* this, class QPoint* __ptr64 arg2) = Qt5Widgets:QWidget::redirected(QWidget* this, class QPoint* __ptr64) const__ptr64
- class QPainter* __ptr64 (* const vFunc_6)(QWidget* this) = Qt5Widgets:QWidget::sharedPainter(QWidget* this) const__ptr64
-}
-```
-
-_The above listing includes type information deduced separately through demangled names_
+Parses and symbolizes C++ RTTI information in [Binary Ninja].
## Exposed Metadata
-This plugin will store metadata on the view queryable view the `msvc` key.
+This plugin will store metadata on the view queryable view the `rtti` key.
### Example Metadata
-```py
-# data = bv.query_metadata("msvc")
-data = {
- "classes": {
- "5368823328": {
- "className": "Animal",
- "vft": {
- "address": 5368818736,
- "functions": [{"address": 5368779647}, {"address": 5368779152}],
- },
- },
- "5368823464": {
- "className": "Flying",
- "vft": {"address": 5368818768, "functions": [{"address": 5368778982}]},
- },
- "5368823600": {
- "baseClassName": "Animal",
- "className": "Bird",
- "vft": {
- "address": 5368818816,
- "functions": [{"address": 5368779137}, {"address": 5368779272}],
- },
- },
- "5368823808": {
- "baseClassName": "Flying",
- "className": "Bird",
- "classOffset": 16,
- "vft": {"address": 5368818848, "functions": [{"address": 5368778982}]},
- },
- "5368823856": {
- "className": "type_info",
- "vft": {"address": 5368818888, "functions": [{"address": 5368778927}]},
- },
- }
-}
+```pycon
+>>> pprint.pp(bv.auto_metadata['rtti'])
+{'classes': {'4294983728': {'className': 'ParentA',
+ 'processor': 1,
+ 'vft': {'address': 4294983784}},
+ '4294983744': {'bases': [{'className': 'ParentA',
+ 'classOffset': 0,
+ 'vft': {'address': 4294983784}}],
+ 'className': 'SomeClass',
+ 'processor': 1,
+ 'vft': {'address': 4294983712}},
+ '4294983864': {'className': 'ParentB',
+ 'processor': 1,
+ 'vft': {'address': 4294983952}},
+ '4294983880': {'bases': [{'className': 'ParentA',
+ 'classOffset': 0,
+ 'vft': {'address': 4294983784}},
+ {'className': 'ParentB',
+ 'classOffset': 16,
+ 'vft': {'address': 4294983952}}],
+ 'className': 'MultiSomeClass',
+ 'processor': 1,
+ 'vft': {'address': 4294983848}}}}
```
[Binary Ninja]: https://binary.ninja \ No newline at end of file