Reputation: 91
I am trying to find the address (or offset from base address) of the 'vftable' symbol for the class 'Greeter' by statically analyzing an executable file. While analyzing it dynamically in Visual Studio by adding a breakpoint and disassembling the constructor of the 'Greeter' class, I was able to find the address of the symbol.
00007FF76A891951 lea rcx,[Greeter::`vftable' (07FF76A89ACE0h)]
00007FF76A891958 mov qword ptr [rax],rcx
But this is it's runtime address. I need to find a way to figure out the offset by maybe using a tool like 'dumpbin' or something similar. I know I can figure out the offset by using the address above, but I need a way to automate this, so it will have to be through a tool.
I tried using 'dumpbin' on the exe to disassemble it and find the same instructions of the Greeter class:
0000000140011951: 48 8D 0D 88 93 00 lea rcx,[??_7Greeter@@6B@]
0000000140011958: 48 89 08 mov qword ptr [rax],rcx
So, I set out to try to find references to this symbol ??_7Greeter@@6B@
I tried using 'dumpbin' with the following command:
dumpbin /all ConsoleApplication.obj > cout
I got the following relevant output:
Section length 18, #relocs 3, #linenums 0, checksum 0, selection 6 (pick largest)
Relocation CRC BDB82F45
134 00000008 SECT43 notype External | ??_7Greeter@@6B@ (const Greeter::`vftable')
135 00000000 SECT44 notype Static | .rdata
I also got this output:
SECTION HEADER #43
.rdata name
0 physical address
0 virtual address
18 size of raw data
DA3B file pointer to raw data (0000DA3B to 0000DA52)
DA53 file pointer to relocation table
0 file pointer to line numbers
3 number of relocations
0 number of line numbers
40401040 flags
Initialized Data
COMDAT; sym= "const Greeter::`vftable'" (??_7Greeter@@6B@)
8 byte align
Read Only
RAW DATA #43
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010: 00 00 00 00 00 00 00 00 ........
RELOCATIONS #43
Symbol Symbol
Offset Type Applied To Index Name
-------- ---------------- ----------------- -------- ------
00000000 ADDR64 00000000 00000000 14C ??_R4Greeter@@6B@ (const Greeter::`RTTI Complete Object Locator')
00000008 ADDR64 00000000 00000000 8C ?sayHello@Greeter@@UEAAX_J00@Z (public: virtual void __cdecl Greeter::sayHello(__int64,__int64,__int64))
00000010 ADDR64 00000000 00000000 8D ?initUser@Greeter@@UEAAXXZ (public: virtual void __cdecl Greeter::initUser(void))
Does anybody have any idea how I would go about finding the offset of this symbol? Is there a specific 'dumpbin' option that I need to use to print offset of symbols that are mentioned in the disassembly?
Upvotes: 2
Views: 305