From e299a6c1bf74f0ca6d2c3d79135e8c23e6b9fbba Mon Sep 17 00:00:00 2001 From: Mason Reed Date: Mon, 12 Jan 2026 10:58:59 -0800 Subject: [RTTI] Improve virtual function discovery - Allow extern functions to show up in a MSVC vtable - Fix https://github.com/Vector35/binaryninja-api/issues/7871 - Share code between itanium and msvc vft analysis, it is the same logic basically --- plugins/rtti/rtti.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'plugins/rtti/rtti.h') diff --git a/plugins/rtti/rtti.h b/plugins/rtti/rtti.h index b46a33a1..00b105eb 100644 --- a/plugins/rtti/rtti.h +++ b/plugins/rtti/rtti.h @@ -6,6 +6,8 @@ constexpr const char *VIEW_METADATA_RTTI = "rtti"; constexpr int RTTI_CONFIDENCE = 100; namespace BinaryNinja::RTTI { + Ref GetRealSymbol(BinaryView *view, uint64_t relocAddr, uint64_t symAddr); + std::optional DemangleNameMS(BinaryView* view, bool allowMangled, const std::string &mangledName); std::optional DemangleNameGNU3(BinaryView* view, bool allowMangled, const std::string &mangledName); @@ -69,6 +71,14 @@ namespace BinaryNinja::RTTI { class RTTIProcessor { protected: + enum class FunctionDiscoverState + { + Failed = 0, + AlreadyExists = 1, + Discovered = 2, + Extern = 3 + }; + Ref m_view; Ref m_logger; @@ -78,6 +88,10 @@ namespace BinaryNinja::RTTI { virtual std::optional ProcessRTTI(uint64_t objectAddr) = 0; virtual std::optional ProcessVFT(uint64_t vftAddr, ClassInfo &classInfo, std::optional baseClassInfo) = 0; + + [[nodiscard]] bool IsLikelyFunction(uint64_t addr) const; + + [[nodiscard]] FunctionDiscoverState DiscoverVirtualFunction(uint64_t vftEntryAddr, uint64_t& vFuncAddr); public: virtual ~RTTIProcessor() = default; -- cgit v1.3.1