Get Vtable Index

Get VTable Index

Find a function's position (offset and index) within a vtable by iterating through vtable entries.

Prerequisites

• Function address (from decompilation or xrefs)
• ClassName (to get vtable via get-vtable-address skill)
• platform (either windows or linux, depending on the binary we are analyzing)

Method

1. Load vtable YAML and find function index:

ALWAYS first check if {ClassName}_vtable.{platform}.yaml exists beside the binary, then search for the function in vtable_entries:

```python mcp__ida-pro-mcp__py_eval code=""" import idaapi import yaml import os

# === REQUIRED: Replace these values === classname = "" # e.g., "CCSPlayerPawn" funcaddr = # Target function address to find # ======================================

inputfile = idaapi.getinputfilepath() dirpath = os.path.dirname(inputfile) platform = 'windows' if input_file.endswith('.dll') else 'linux'

yamlpath = os.path.join(dirpath, f"{classname}vtable.{platform}.yaml")

if not os.path.exists(yamlpath): print(f"ERROR: Required file {classname}vtable.{platform}.yaml not found.") print(f"Expected path: {yamlpath}") print(f"Please run /find-{class_name}_vtable first to generate the vtable YAML file.") else: with open(yamlpath, 'r', encoding='utf-8') as f: data = yaml.safeload(f)

vtableentries = data.get('vtableentries', {}) vtableva = data.get('vtableva') ptrsize = 8 if idaapi.infis_64bit() else 4

for idx, entry in vtableentries.items(): # Handle both int and hex string formats i = int(idx) if isinstance(idx, str) else idx entryaddr = int(entry, 16) if isinstance(entry, str) else entry if entryaddr == funcaddr: offset = i * ptrsize print(f"Found at vfuncoffset: {hex(offset)}, vfuncindex: {i}") print(f"vtableva: {hex(vtableva) if isinstance(vtableva, int) else vtableva}") break else: print(f"Function {hex(funcaddr)} not found in {class_name} vtable entries!") """ ```

Replace:

• ` with the target class name (e.g., CCSPlayerPawn`)
• `` with the target function address

IMPORTANT: Use the function entry address. VTables store pointers to the function start; string xrefs often land in the middle of a function. If you only have an address inside the function, resolve the real entry first: ``python mcp__ida-pro-mcp__py_eval code=""" import idaapi addr_inside_func = f = idaapi.get_func(addr_inside_func) print(f"Function entry: {hex(f.start_ea)}" if f else "Not inside a function") """ ``

2. Continue with the unfinished tasks

If we are called by a task from a task list / parent SKILL, restore and continue with the unfinished tasks.

Formulas

• vfunc_offset = index × ptr_size (ptr_size = 8 for 64-bit, 4 for 32-bit)
• vfunc_index = offset / ptr_size, and is the index of the entry in vtable_entries.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: HLND2T
• Source: HLND2T/CS2_VibeSignatures
• License: MIT

Install and usage instructions live in the source repository linked above.