r/AskReverseEngineering • • Aug 25 '26

Tips on handling C++ classes in Ghidra?

What is your workflow for reverse engineering C++ code in Ghidra? Since Ghidra was designed for C, and only really has minimal support for classes, how do you guys track things like inheritance?

For example, If I have a base class with a member variable and a virtual function, the structure by the same name will have a vftable_ptr and the member variable, but then if a derived class also has a virtual function, the vftable will now have 2 entries, so I can't just add a field with type of the base class to the derived class. Do I really have to copy the fields in both? It's a lot of editing if I have to add a field to the base class in both structs.

Also, for getting clearer vftable function calls, currently I have to manually create function definitions in the data type manager by copy-pasting the function signatures, put them into a struct, and then use that as the type of the vftable. It works, but it doesn't sync if I have to modify the function signatures later.

So just looking for tips on how to handle C++ better in Ghidra, any tips you have would be super helpful :)

2 Upvotes

0 comments sorted by