skills.rest
vzco
vzcoOFFICIAL
Explore all skills by this author →
GitHub

analyze-vtable

Analyze C++ virtual function tables to map entries and label overrides.

15|4|Updated Mar 7, 2026
Search Tags:#debugging#cpp#analyze#reverse-engineering#disassembly#vtable
One-click install
npx skills add https://github.com/vzco/arc-probe --skill analyze-vtable
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: analyze-vtable
Source: https://github.com/vzco/arc-probe/tree/main/plugins/arc-probe/skills/analyze-vtable
Command: npx skills add https://github.com/vzco/arc-probe --skill analyze-vtable

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps software engineers quickly understand and document complex C++ virtual function tables by automatically mapping vtable entries, class relationships, and entry types.

Core Features & Use Cases

  • Resolve vtable addresses from RTTI or direct pointers.
  • Disassemble and categorize entries into destructors, getters, setters, thunks, pure virtuals, and overrides.
  • Compute vtable size and inheritance relationships to identify overrides and inherited entries.
  • Detect string references and other ref data to aid interpretation.
  • Use Case: debugging, reverse engineering, and documenting interfaces.

Quick Start

Provide a class name supported by RTTI or a direct vtable address to begin analysis.

Frequently Asked Questions about analyze-vtable

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a C++ vtable to map virtual function entries during reverse engineering?▼

Vtable analysis disassembles entries to categorize virtual functions into destructors, getters, setters, and thunks. It resolves vtable addresses via RTTI or direct pointers, measuring table size and detecting string references to document class interfaces.

Can I detect overridden and inherited C++ virtual functions from a binary?▼

Detecting overridden C++ virtual functions involves computing inheritance relationships to compare vtable entries. This identifies overridden and inherited methods by mapping class relationships within RTTI-enabled binaries or direct vtable addresses.

Does vtable analysis work with binaries that lack RTTI information?▼

Vtable analysis works without RTTI by accepting direct vtable addresses as input. Providing a direct pointer bypasses the need for RTTI, allowing you to manually map entries, classify functions, and detect string references in stripped binaries.

What's the best way to identify pure virtual functions and destructors in a disassembled vtable?▼

Identifying pure virtual functions and destructors in a disassembled vtable requires entry classification via disassembly. This categorizes entries into destructors, pure virtuals, thunks, getters, and setters to clarify the class behavior.

Why do I need to map vtable string references when debugging C++ binaries?▼

Mapping vtable string references during debugging links virtual entries to contextual data. Detecting these references aids interpretation by revealing associated data interactions, clarifying the purpose of getters, setters, and overrides.

Related Skills

Explore More Software Engineering Skills→
vzcovzco
15

map-struct

Map C++ object memory layouts from addresses using RTTI and hex dumps.

Official
Intermediate
vzcovzco
15

discover-class

Map a C++ class's vtable and inheritance chain in a running process via RTTI.

Official
Advanced
HLND2THLND2T
60

find-CCSPlayer_ItemServices_GiveNamedItem

Identify CCSPlayer_ItemServices_GiveNamedItem function in CS2 binaries via IDA Pro MCP string search and vtable analysis.

Official
Advanced
hzqsthzqst
60

find-g_pGameTypes-AND-IGameTypes_CreateWorkshopMapGroup

Locate and generate signatures for g_pGameTypes and IGameTypes_CreateWorkshopMapGroup in CS2 server binaries.

Community
Advanced