Search code examples
memoryvisual-c++rttivtablemsvcrt

Get class name based on address of its instance in another process


I'm looking for anything that can help me deviate string GetRTTIClassName(IntPtr ProcessHandle, IntPtr StructAddress). The function would use another (third-party) app's process handle to get names of structures located at specific addresses in its memory (should there be found any).

All of RTTI questions/documentation I can find relate to it being used in the same application, and have nothing to do with process interop. The only thing close to what I'm looking for is this module in Cheat Engine's source code (which is also how I found out that it's possible in the first place), but it has over a dozen of nested language-specific dependencies, let alone the fact that Lazarus won't let me build it outside of the project context anyway.

If you know of code examples, libraries, documentation on what I've described, or just info on accessing another app's low-level metadata (pardon my French), please share them. If it makes a difference, I'm targeting C#.


Edit: from what I've gathered, the way runtime information is stored depends on the compiler, so I'll mention that the third-party app I'm "exploring" is a MSVC project.

As I understand, I need to:

  1. Get address of the structure based on address of its instance;
  2. Starting from structure address, navigate through pointers to find its name (possibly "decorated").

I've also found a more readable C# implementation and a bunch of articles on reversing (works for step 2), but I can't seem to find step 1.

I'll update/comment as I find more info, but right now I'm getting a headache just digging into this low-level stuff.


Solution

  • It's a pretty long pointer ladder. I've transcribed the solution ReClass.NET uses to clean C# without dependencies.

    Resulting library can be found here.