Does not define actual structures for Delphi classes

[Philosoph228]

Hi! On screenshots in the README you've shown a Delphi method with first parameter resolved as TForm01_Self.
I've tried to run an analysis and got int a1<eax> instead. I don't see any *_Self local types defined.

[nyx0]

Hello @Philosoph228! To help us to understand the issue, could you provide the following information please?

• Operating System
• IDA version
• Python version
• binary

Thanks a lot

[Philosoph228]

@nyx0 okay.

1. Windows 10 22H2 (OS Build 19045.6456)
2. IDA 9.1.250226 Windows x64 (64-bit address size)
3. Python 3.11.9 (tags/v3.11.9:de54cf5, Apr 2 2024, 10:12:12) [MSC v.1938 64 bit (AMD64)] IDAPython 64-bit v9.1.0 (c) The IDAPython Team idapython@googlegroups.com
4. Sorry. Unfortunately, I can't share the actual binary I'm working with due to a non-disclosure agreement. But the issue can be reproduced with any Delphi 7-2008? 32-bit application, even simple TForm with label and button (I've attached a minimal reproducible example: Project1.zip).

Based on the screenshots (https://github.com/eset/DelphiHelper/raw/github/img/CallVMTFunc_After.PNG), I expected the plugin to create actual data structures for classes so that they could be observed by expanding each member during debugging in the Locals and Watches windows.
For now I see the code decompiled like this with int a1:

int __fastcall TForm1_Button1Click(int a1)
{
  return TButton_SetCaption(*(Controls::TControl **)(a1 + 760), (const int)&str_Hello_World_[1]);
}

And in the Local Types window, I don't see any actual data structures created to map to a1. I only see enum _Fields defitions and VMTs for classes.

I took a quick look at the plugin's code and didn't find anything that looked like what I was expecting. I don't know if this is a missing feature?

What I actually mean. Let's look at Form1 class with it's inheritance hierarchy:

TObject
└ TPersistent
  └ TComponent
    └ TControl
      └ TWinControl
        └ TScrollingWinControl
          └ TCustomForm
            └ TForm
              └ TForm1

The memory at _Self* pointer would be:

+---------+---------+--------+--------------------------------------------+
| Offset  | Size    | Type   | Description                                |
+---------+---------+--------+--------------------------------------------+
|     0x0 |     0x4 | DWORD  | Pointer to TForm1 VMT                      |
+---------+---------+--------+--------------------------------------------+
|     0x4 |     0x0 |        | // TPersistent doesn't have any own fields |
+---------+---------+--------+--------------------------------------------+
|     0x4 |    0x2C | Struct | TComponent Fields                          |
+---------+---------+--------+--------------------------------------------+
|    0x30 |   0x12C | Struct | TControl Fields                            |
+---------+---------+--------+--------------------------------------------+
|   0x15C |    0xA8 | Struct | TWinControl Fields                         |
+---------+---------+--------+--------------------------------------------+
|   0x204 |    0x18 | Struct | TScrollingWinControl Fields                |
+---------+---------+--------+--------------------------------------------+
|   0x21C |    0xDC | Struct | TCustomForm Fields                         |
+---------+---------+--------+--------------------------------------------+
|   0x21C |     0x0 |        | // TForm doesn't have any own fields       |
+---------+---------+--------+--------------------------------------------+
|   0x2F8 |     0x8 | Struct | TForm1 Fields                              |
+---------+---------+--------+--------------------------------------------+

It would be possible to generate structures like this:

__declspec(align(4))
struct TComponent_Fields {  // sizeof=0x30
  TComponent* FOwner;   // 4 bytes pointer to TComponent
  TComponentName* Name; // 4 bytes pointer to TComponentName
  int Tag;              // 4 bytes int
  TList* FComponents;   // 4 bytes pointer to TList
  TList* FFreeNotifies; // 4 bytes pointer to TList
  int FDesignInfo;      // 4 bytes long int
  TComponentState* FComponentState; // 4 bytes
  void* FVCLComObject;  // 4 bytes pointer
  TComponentStyle* FComponentStyle;
  void* Interface1;     // 4 bytes pointer
  void* Interface2;     // 4 bytes pointer  
};

...

__declspec(align(4))
struct TForm1_Fields {  // sizeof=0x8
  TLabel* Label1;   // 4 bytes pointer ot TLabel
  TButton* Button1; // 4 bytes pointer to TButton     
};

__declspec(align(4))
struct TForm1_Self {
  struct TForm1_VMT* __vmt;
  struct TComponent_Fields __TComponent;
  struct TControl_Fields __TControl;
  struct TWinControl_Fields __TWinControl;
  struct TScrollingWinControl_Fields __TScrollingWinControl;
  struct TCustomForm_Fields __TCustomForm;
  struct TForm_Fields __TForm1;
};

And deobfuscate the code:

int __fastcall TForm1_Button1Click(TForm1_Self* Self)
{
  return TButton_SetCaption(Self->__TForm1->Label1, (const int)&str_Hello_World_[1]);
}

Yes, this is yet too simple code example. But real problem comes with dealing with huge obfuscated VMT calls like:

(*(void (__stdcall **)(_DWORD, void *, int *))(**(_DWORD **)(a1 + 856) + 216))(HIDWORD(v13), v14, v15);