MCPcopy Create free account
hub / github.com/ajkhoury/ReClassEx / ResolveRTTI

Method ResolveRTTI

ReClass/CNodeBase.cpp:213–411  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

211}
212
213int CNodeBase::ResolveRTTI( ULONG_PTR Address, int x, const PVIEWINFO View, int y )
214{
215#if defined(_M_AMD64)
216 ULONG_PTR ModuleBase = 0;
217
218 ULONG_PTR RTTIObjectLocatorPtr = 0;
219 ULONG_PTR RTTIObjectLocator = 0;
220
221 ULONG ClassHierarchyDescriptorOffset = 0;
222 ULONG_PTR ClassHierarchyDescriptor = 0;
223
224 ULONG NumBaseClasses = 0;
225
226 DWORD BaseClassArrayOffset = 0;
227 ULONG_PTR BaseClassArray = 0;
228
229 CString RttiString;
230
231 // Get module base that this address falls in
232 ModuleBase = GetModuleBaseFromAddress( Address );
233 if (!ModuleBase)
234 return x;
235
236 RTTIObjectLocatorPtr = Address - sizeof( ULONG64 ); // Address is Ptr to first VFunc, pRTTI is at -0x8
237 if (!IsValidPtr( RTTIObjectLocatorPtr ))
238 return x;
239
240 ReClassReadMemory( (LPVOID)RTTIObjectLocatorPtr, &RTTIObjectLocator, sizeof( ULONG_PTR ) );
241
242 ReClassReadMemory( (LPVOID)(RTTIObjectLocator + 0x10), &ClassHierarchyDescriptorOffset, sizeof( ULONG ) );
243
244 ClassHierarchyDescriptor = ModuleBase + ClassHierarchyDescriptorOffset;
245 if (!IsValidPtr( ClassHierarchyDescriptor ) || !ClassHierarchyDescriptorOffset)
246 return x;
247
248 ReClassReadMemory( (LPVOID)(ClassHierarchyDescriptor + 0x8), &NumBaseClasses, sizeof( ULONG ) );
249 if (NumBaseClasses < 0 || NumBaseClasses > 25)
250 NumBaseClasses = 0;
251
252 ReClassReadMemory( (LPVOID)(ClassHierarchyDescriptor + 0xC), &BaseClassArrayOffset, sizeof( ULONG ) );
253
254 BaseClassArray = ModuleBase + BaseClassArrayOffset;
255 if (!IsValidPtr( BaseClassArray ) || !BaseClassArrayOffset)
256 return x;
257
258 for (ULONG i = 0; i < NumBaseClasses; i++)
259 {
260 ULONG BaseClassDescriptorOffset = 0;
261 ULONG_PTR BaseClassDescriptor = 0;
262
263 ULONG TypeDescriptorOffset = 0;
264 ULONG_PTR TypeDescriptor = 0;
265
266 if (i != 0 && i != NumBaseClasses)
267 {
268 RttiString += TEXT( " : " ); // Base class
269 }
270

Callers

nothing calls this directly

Calls 2

GetModuleBaseFromAddressFunction · 0.85
ReClassReadMemoryFunction · 0.85

Tested by

no test coverage detected