Zuk.Virt.Resolve - Identify and resolve virtual C++ function calls automatically.

[zkxjzmswkwl]

Indirect, and by extension, virtual function calls, slow down analysis considerably.

To illustrate that, let's play a game. "Which one of the following do you hate?"

(_DWORD *)sub_1746B0();

or

// This calls out to varous virtual methods. It differs for each entity you are actioning against.
(*(void (__fastcall **)(__int64, __int64))(*(_QWORD *)v13 + 0x10LL))(v13, a2);

Answer's obvious. Typically, the fastest way to go about figuring out *where* this call is actually going is to attach a debugger and set a breakpoint. Except it could be going to many different locations, so you'll be stepping through quite a bit of ****, noting the RIP each call, etc.

This tool automates that process.

Source code here

Aside

• C# is the language I have the least experience with. The code isn't idiomatic and likely never will be.
• The codebase was written to target exclusively x86_64. If you're still working on 32-bit binaries you should already know everything there is to know about your target.
• There is no detach button (as of writing this). Will fix.