Devirtualizing C++ with Binary Ninja

Summary: Trail of Bits published a Binary Ninja plugin, vtable-navigator.py, that resolves C++ virtual function calls by using Low Level IL to find a class's vtable in its constructor and then tracing register assignments back from the call instruction to compute the function offset. The plugin works on both x86-64 and ARM binaries without architecture-specific code, demonstrated on a modified C++ tutorial compiled for both.
Why it matters: Indirect calls through vtables are where reverse engineering C++ binaries stalls, and a tool that resolves them from the call site turns an opaque `call rax` into a named function - useful to anyone analyzing compiled code for vulnerabilities without source.

Read the original at Trail of Bits Blog ↗