get-vtable-index

Get VTable Index

Find a function's position (offset and index) within a vtable by iterating through vtable entries.

Prerequisites

• Function address (from decompilation or xrefs)
• ClassName (to get vtable via get-vtable-address skill)
• platform (either windows or linux, depending on the binary we are analyzing)
• An IDA Pro MCP session, resolved per mcp-ida-session.md: idb_list → idb_open (script fallback only if the endpoint is unreachable). Honor its IDB save discipline — an idle-TTL self-exit does not save.

Method

1. Load vtable YAML and find function index:

ALWAYS first check if {ClassName}_vtable.{platform}.yaml exists beside the binary, then search for the function in vtable_entries:

mcp__ida-pro-mcp__py_eval code="""
import idaapi
import yaml
import os

# === REQUIRED: Replace these values ===
class_name = "<ClassName>"        # e.g., "CCSPlayerPawn"
func_addr = <FUNC_ADDRESS>        # Target function address to find
# ======================================

input_file = idaapi.get_input_file_path()
dir_path = os.environ.get('CS2VIBE_ARTIFACT_DIR') or os.path.dirname(input_file)
platform = 'windows' if input_file.endswith('.dll') else 'linux'

yaml_path = os.path.join(dir_path, f"{class_name}_vtable.{platform}.yaml")

if not os.path.exists(yaml_path):
    print(f"ERROR: Required file {class_name}_vtable.{platform}.yaml not found.")
    print(f"Expected path: {yaml_path}")
    print(f"Please run `/find-{class_name}_vtable` first to generate the vtable YAML file.")
else:
    with open(yaml_path, 'r', encoding='utf-8') as f:
        data = yaml.safe_load(f)

    vtable_entries = data.get('vtable_entries', {})
    vtable_va = data.get('vtable_va')
    ptr_size = 8 if idaapi.inf_is_64bit() else 4

    for idx, entry in vtable_entries.items():
        # Handle both int and hex string formats
        i = int(idx) if isinstance(idx, str) else idx
        entry_addr = int(entry, 16) if isinstance(entry, str) else entry
        if entry_addr == func_addr:
            offset = i * ptr_size
            print(f"Found at vfunc_offset: {hex(offset)}, vfunc_index: {i}")
            print(f"vtable_va: {hex(vtable_va) if isinstance(vtable_va, int) else vtable_va}")
            break
    else:
        print(f"Function {hex(func_addr)} not found in {class_name} vtable entries!")
"""