Virtuailor is an IDAPython tool that reconstructs vtables for C++ code written for intel architecture, both 32bit and 64bit code and AArch64 (New!). The tool constructed from 2 parts, static and dynamic.
The first is the static part, contains the following capabilities:
The second is the dynamic part, contains the following capabilities:
Virtuailor now supports IDA versions from 7.0 to the newest version (7.5), if you are using IDA versions older than 7.4 you will need to switch to branch beforeIDA-7.4, master branch supports the newest version available (7.5).
if __name__ == '__main__': start_addr_range = idc.MinEA() # You can change the virtual calls address range end_addr_range = idc.MaxEA() add_bp_to_virtual_calls(start_addr_range, end_addr_range)
Optional, (but extremely recommended), create a snapshot of your idb. Just press ctrl+shift+t and create a snapshot.
Press File->Run script... then go to Virtuailor folder and choose to run Main.py, You can see the following gif for a more clear and visual explanation.
Now the GUI will provide you an option to choose a range to target, in case you would like to target all the binary just press OK with the default values in the start and end addresses.
Afterwards the breakpoints will be placed in your code and all you have to do is to execute your code with IDA debugger, do whatever actions you want and see how the vtables is being built! For AArch64 you can setup a remote gdb server and debug using the IDA debuggger.
In case you don't want/need the breakpoints anymore just go to the breakpoint list tab in IDA and delete the breakpoints as you like.
It is also really important for me to note that this is the second version of the tool with both 32 and 64 bit support and aarch64, probably in some cases a small amount of breakpoints will be missed, in these cases please open an issue and contact me so I will be able to improve the code and help fixing it. Thank you in advanced for that :)
The structures Virtuailor creates from the vtable used in virtual call that were hit. The vtable functions are extracted from the memory based on the relevant register that was used in the BP opcode.
Since I wanted to create a correlation between the structure in IDA and the vtables in the data section, the BP changes the vtable address name in the data section to the name of the structure. As you can see in the following picture:
The virtual functions names are also being changed, take aside situations where the names are not the default IDA names (functions with symbols or functions that the user changed) in those cases the function names will stay the same and will also be add to the vtable structure with their current name.
The chosen names is constructed using the following pattern:
After creating the vtable Virtuailor also adds a connection between the structure created and the assembly as you can see in the following images:
P.S: The structure offset used in the BP is only relevant for the last call that was made, in order to get a better understanding of all the virtual calls that were made the xref feature was added as explained in the next section
When reversing C++ statically it is not trivial to see who called who, this is because most calls are indirect calls, however after running Virtuailor every function that was called indirectly now has an xref to those locations.
The following gif shows the added Xrefs with their indirect function call:
The tool was presented in RECon brussels, Troopers and Warcon. The presentation could be found in the following link: https://www.youtube.com/watch?v=Xk75TM7NmtA
REcon Brussels, Troopers, Warcon crews, Nana, @tmr232, @matalaz, @oryandp, @talkain, @shiftreduce
The plugin is licensed under the GNU GPL v3 license.