{"id":4035,"date":"2019-11-15T08:03:36","date_gmt":"2019-11-15T08:03:36","guid":{"rendered":"http:\/\/mertboru.com\/?p=4035"},"modified":"2020-07-27T07:46:14","modified_gmt":"2020-07-27T07:46:14","slug":"demystifying-vmt-and-rtti-in-unreal-engine-c","status":"publish","type":"post","link":"http:\/\/mertboru.com\/?p=4035","title":{"rendered":"Demystifying VMT and RTTI in Unreal Engine C++"},"content":{"rendered":"

(Cover Photo: \u00a91984 – ITV Granada<\/em><\/span>
\nJeremy Brett, “Sherlock Holmes” TV Series<\/em><\/span>)<\/em><\/span><\/p>\n

It is no secret that, due to nature of modern OOP guidelines, Unreal Engine C++ source code is full of \u201cvirtual functions\u201d<\/em>. It is also<\/em> no secret that, calling a virtual function is inherently slower than calling a non-virtual function… So, what’s the catch?<\/strong><\/p>\n

A non-virtual call<\/strong><\/em><\/span> is simply a jump (JMP) to a compiled-in pointer. On the other hand, a virtual call<\/strong><\/em><\/span> requires at least an extra indexed dereference, and sometimes a fixup addition, which is stored in a lookup table known as Virtual Method Table (VMT)<\/strong>. This is simply why a virtual call is always slower than a non-virtual call.<\/p>\n

To avoid this overhead, compilers usually steer clear of VMT whenever the call can be resolved at compile time. However, due to complex nature of Inheritence<\/strong> based class structures used in modern game engines, using VMT is unavoidable in most cases.<\/p>\n

\"\"<\/p>\n

Virtual Method Table (VMT)<\/strong><\/p>\n

An object’s VMT<\/strong> (also known as vtable<\/strong>)<\/em> contains the addresses of the object’s dynamically bound methods. Method calls are performed by fetching the method’s address from the object’s virtual method table.<\/p>\n

C++ compiler creates a separate VMT for each class. When an object is created, a virtual pointer (VPTR)<\/strong> to this table is added as a hidden member of this object. The compiler also generates hidden code<\/strong><\/em><\/span> in the constructors of each class to initialize new object’s VPTR to the address of its class’ virtual method table.<\/p>\n

The virtual method table is same for all objects belonging to the same class, and is therefore typically shared between them. Objects belonging to type-compatible classes in an inheritance hierarchy will have virtual method tables with the same layout.<\/p>\n

Tip:<\/strong> The C++ standards do not<\/strong><\/em><\/span> mandate exactly how dynamic dispatch must be implemented, but compilers generally use minor variations on the same basic model. The VMT is generally a good performance trade-off to achieve dynamic dispatch, but there are alternatives, such as Binary Tree Dispatch (BTD)<\/strong>, with higher performance but different costs.<\/div>\n

Speaking of hidden codes and VMTs in the constructors of each class, each C++ object should also contain additional information about its type<\/strong><\/em><\/span>. An object’s data type is a crucial information in terms of casting<\/strong><\/span><\/em>.<\/p>\n

\"\"<\/strong><\/p>\n

Run-Time Type Information\u00a0 (RTTI)<\/strong><\/p>\n

RTTI is a feature of the C++ programming language that exposes information about an object’s data type at runtime. It can apply to simple data types, such as integers and characters, or to generic types.<\/p>\n

Run-Time Type Information\u00a0is available only for classes that are polymorphic<\/strong>, which means they have at least one virtual method<\/strong><\/span><\/em>. In practice, this is not<\/strong> a limitation because base classes must have a virtual destructor to allow objects of derived classes to perform proper cleanup if they are deleted from a base pointer.<\/p>\n

RTTI is used in three main C++ language elements:<\/p>\n

\"\"\u00a0 The dynamic_cast<\/strong><\/em> operator: Used for conversion of polymorphic types.<\/p>\n

\"\"\u00a0 The typeid<\/strong> <\/em>operator: Used for identifying the exact type of an object.<\/p>\n

\"\"\u00a0 The type_info<\/strong><\/em> class: Used to hold the type information returned by the typeid operator.<\/p>\n

In order to perform cast-related operations listed above, RTTI heavily uses VMT<\/strong>. For example, given an object of a polymorphic class, a type_info<\/strong><\/em> object can be obtained through the use of the typeid<\/strong><\/em> operator.\u00a0 In principle, this is a simple operation which involves finding the VMT<\/strong>, through that finding the most-derived class object of which the object is part, and then extracting a pointer to the type_info<\/strong><\/em> object from that object\u2019s virtual function table (or equivalent).<\/p>\n

In terms of performance, using the dynamic_cast<\/strong><\/em> operator is more expensive than type_info<\/strong><\/em>. Given a pointer to an object of a polymorphic class, a cast to a pointer to another base subobject of the same derived class object can be done using a dynamic_cast<\/strong><\/em>.\u00a0 In principle, this operation involves finding the VMT<\/strong>, through that finding the most-derived class object of which the object is part, and then using type information associated with that object to determine if the conversion (cast) is allowed, and finally performing any required adjustments of the pointer.\u00a0 In principle, this checking involves the traversal of a data structure describing the base classes of the most derived class.\u00a0 Thus, the run-time cost of a dynamic_cast<\/strong><\/em> may depend on the relative positions in the class hierarchy of the two classes involved.<\/p>\n

Tip:<\/strong> In the original C++ design, Bjarne Stroustrup did not include RTTI, because he thought this mechanism was often misused.<\/div>\n

\"\"<\/p>\n

Hacking VMT and RTTI Information using UE C++<\/strong><\/p>\n

In order to gather “header”<\/strong><\/em><\/span> information (that contains VMT and RTTI data) in an Unreal Engine C++ class\/object, I have written the following LogClassHeader()<\/strong> C++ function using Visual Studio 2019 version 16.3.8 for Unreal Engine version 4.23.1.<\/p>\n

void<\/span><\/strong> UDebugCore<\/span>::LogClassHeader<\/strong>(void<\/span><\/strong>* const<\/span><\/strong> pThis, size_t<\/span><\/em><\/strong> nSize)\r\n{\r\n  FString<\/span><\/em><\/strong> fsClassName = \"NULL\";\r\n  FString<\/span><\/em><\/strong> fsObjectName = \"NULL\";\r\n  UObject<\/span><\/em><\/strong>* const<\/strong><\/span> pCastedToUObject = (UObject<\/span><\/em><\/strong>*)(pThis);\r\n  void<\/span><\/strong>** const<\/span><\/strong> pCastedToHeader = reinterpret_cast<\/span><\/strong><void<\/span><\/strong>**>(pThis);\r\n\r\n  if<\/span><\/strong> (pCastedToUObject)\r\n  {\r\n    fsClassName = pCastedToUObject->GetClass<\/em>()->GetName<\/em>();\r\n    fsObjectName = pCastedToUObject->GetName<\/em>();\r\n  }\r\n\r\n  if<\/span><\/strong> (pCastedToHeader)\r\n  {\r\n    for<\/span><\/strong> (size_t<\/span><\/em><\/strong> i = 0; i < nSize \/ sizeof<\/span><\/strong>(void<\/span><\/strong>*); i++)\r\n    {\r\n      MACRO_PRINTF<\/span><\/strong>(\"Pointer[%04zu] = 0x%p\", i, pCastedToHeader[i])\r\n    }\r\n  }\r\n}<\/pre>\n
This function has 2 input parameters:<\/p>\n
\"\"\u00a0 pThis:\u00a0<\/strong> Object to extract Class Header Info from<\/em>
\n\"\"\u00a0 nSize:<\/strong>\u00a0 Size of Header<\/em><\/p>\n
Calling the function is very easy. You simply insert your call into the constructor of the class that you would like to hack. For example, the following code gathers C++ header information of <APlayerControllerThirdPerson><\/strong> class.<\/p>\n
APlayerControllerThirdPerson<\/span>::APlayerControllerThirdPerson<\/span>()\r\n{\r\n  UDebugCore<\/span>::LogClassHeader<\/strong>(this<\/span><\/strong>, sizeof<\/span><\/strong>(*this<\/span><\/strong>));\r\n}<\/pre>\n
When you run the code, all pointers that are available (and used) in the header of <APlayerControllerThirdPerson> will be listed. And, in case you need, instance name<\/strong> and class type<\/strong> is stored in fsObjectName<\/em> and fsClassName<\/em> variables, as a bonus.<\/p>\n
Pointer[0000] = 0x00007FFC8A3ECB00\r\nPointer[0001] = 0x0000BC5B00000231\r\nPointer[0002] = 0x000001648346AC00\r\nPointer[0003] = 0x000AAD5B000AAD5B\r\nPointer[0004] = 0x0000000000000000\r\nPointer[0005] = 0x00000164834864E0\r\nPointer[0006] = 0x00007FFCAAB2EF98\r\nPointer[0007] = 0x00007FFCA8708208\r\nPointer[0008] = 0x0000000F00000000\r\n            .....\r\n             ...\r\n              .<\/pre>\n
So, what do these numbers mean? Well, all these pointers are addresses of the virtual functions, followed by some of the member variables. In order to understand which is which, we need to decipher the structure of the data set.<\/p>\n
Here comes the tricky part! With each and every update to Visual Studio C++ compiler, the structure tends to get updated as well. In other words, the header structure of a C++ class changes with each major compiler update. Try to think of it as a “living organism”<\/em><\/strong>. As I’m typing this sentence now, a new update with a new C++ header structure may be on its way. So, it is up to you (!) to analyze<\/strong><\/em><\/span> what’s going on under the hood.<\/p>\n
Good news is, we can gather <template> information about C++ class header structure from the official Microsoft patent documents<\/strong>! Although they are not up-to-date, I think it is a good practice to start the investigation using the source of information itself.<\/p>\n
Here is some of the Microsoft patents which describe various parts of C++ implementation used in Visual Studio:<\/p>\n
\"\"\u00a0 US Patent #5410705<\/a>:<\/strong> \u201cMethod for generating an object data structure layout for a class in a compiler for an object-oriented programming language\u201d<\/em><\/p>\n
\"\"\u00a0 US Patent #5617569<\/a>:<\/strong> \u201cMethod and system for implementing pointers to members in a compiler for an object-oriented programming language\u201d<\/em><\/p>\n
\"\"\u00a0 US Patent #5754862<\/a>:<\/strong> \u201cMethod and system for accessing virtual base classes\u201d<\/em><\/p>\n
\"\"\u00a0 US Patent #5297284<\/a>:<\/strong> \u201cMethod and system for implementing virtual functions and virtual base classes and setting a this pointer for an object-oriented programming language\u201d<\/em><\/p>\n
\"\"\u00a0 US Patent #5371891<\/a>:<\/strong> \u201cMethod for object construction in a compiler for an object-oriented programming language\u201d<\/em><\/p>\n
\"\"\u00a0 US Patent #5603030<\/a>:<\/strong> \u201cMethod and system for destruction of objects using multiple destructor functions in an object-oriented computer system\u201d<\/em><\/p>\n
So, what I’m offering is, good old-fashioned \u201creverse engineering\u201d<\/em><\/strong><\/span>.<\/p>\n
– “Is such a challenge worth it?”<\/em><\/p>\n
– “Um, yes!… If it doesn’t break you, it can make<\/strong> you.”<\/em><\/p>\n
\"\"<\/p>\n
References:<\/strong><\/p>\n
\"\"\u00a0 Bjarne Stroustrup, \u201cA History of C++: 1979\u20141991\u201d<\/em>, p. 50 \u2013 (March 1993)<\/p>\n
\"\"\u00a0 Keith Cooper & Linda Torczon, \u201cEngineering A Compiler\u201d<\/em>, Morgan Kaufmann, 2nd Edition \u2013 (2011)<\/p>\n
\"\"\u00a0 Microsoft Visual Studio Documentation, \u201cC++ Run-Time Type Information\u201d<\/em> – (November 2016)<\/p>\n
\"\"\u00a0 \u201cTechnical Report on C++ Performance\u201d<\/em>, OpenRCE.org \u2013 (September 2006)<\/p>\n
\"\"\u00a0 \u201cReversing Microsoft Visual C++: Classes, Methods and RTTI\u201d<\/em>, OpenRCE.org \u2013 (September 2006)<\/p>\n
\"\"\u00a0 \u201cIntel\u00ae 64 and IA-32 Architectures Optimization Reference Manual\u201d<\/em> \u2013 (April 2018)<\/p>\n","protected":false},"excerpt":{"rendered":"
(Cover Photo: \u00a91984 – ITV Granada Jeremy Brett, “Sherlock Holmes” TV Series) It is no secret that, due to nature of modern OOP guidelines, Unreal Engine C++ source code is full of \u201cvirtual functions\u201d. It is also no secret that, calling a virtual function is inherently slower than calling a non-virtual function… So, what’s the … Continue reading Demystifying VMT and RTTI in Unreal Engine C++<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":6648,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26,7],"tags":[175,233,231,230,232,227,226,234,235,44,229,223,224,228,225],"class_list":["post-4035","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-articles","category-gamedev","tag-c-c","tag-dynamic_cast","tag-inheritence","tag-non-virtual-call","tag-polymorphic","tag-rtti","tag-run-time-type-information","tag-typeid","tag-type_info","tag-unreal-engine","tag-virtual-call","tag-virtual-method-table","tag-vmt","tag-vptr","tag-vtable"],"_links":{"self":[{"href":"http:\/\/mertboru.com\/index.php?rest_route=\/wp\/v2\/posts\/4035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/mertboru.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/mertboru.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/mertboru.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/mertboru.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4035"}],"version-history":[{"count":1,"href":"http:\/\/mertboru.com\/index.php?rest_route=\/wp\/v2\/posts\/4035\/revisions"}],"predecessor-version":[{"id":6649,"href":"http:\/\/mertboru.com\/index.php?rest_route=\/wp\/v2\/posts\/4035\/revisions\/6649"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/mertboru.com\/index.php?rest_route=\/wp\/v2\/media\/6648"}],"wp:attachment":[{"href":"http:\/\/mertboru.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/mertboru.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4035"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/mertboru.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}