Jump to content
Moopler
  • 0
Sign in to follow this  
SunCat

Question How to create/update vtables

Question

Hey guys,

I've been spending the last few months trying to improve my reversing/hacking and want to keep learning.

A while back I found the firefly source and it's been a really useful resource to have.

It made me want to learn how to use vtables and I've managed to use the ones from firefly with some level of success, but I'm not sure how to go about updating the ones that are outdated or creating my own.

 

My real question is, how do you find the full structure of the maple classes?

  • Like 1

Share this post


Link to post

2 answers to this question

Recommended Posts

  • 0

Static analysis in IDA basically allows you to find everything if you understand it and know a starting point which leads to a chain of other methods in other classes. Not going to go in depth on that. My days are pretty much officially over. If you are lazy / going into unknown turf and unsure the what data structures are for whatever application you are checking then try using: https://github.com/dude719/ReClassEx. It can save you a lot of time and is pretty skid friendly (no offense). Once you figure out where data you want is located either break and trace back to the functions and xref around to find helpers or misc. Remember to take notes while doing so.

Share this post


Link to post
  • 0

Thanks for the response. I’ve since done a lot of reading and have a much better understanding. I wanted to give ReClass a go, but unfortunately I can’t get it to attach to maple, so I’ve been sticking with CE dissector. 

 

EDIT: I was using normal ReClass, looks like ReClassEx attaches to maple just fine, thanks! :)

Edited by SunCat
  • Like 2
  • Haha 1

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
×