ps2-cpp-rtti

---
name: ps2-cpp-rtti
description: Recover C++ class names, type_info objects, type-info (__tf) functions and vtables from PlayStation 2 executables with ps2re rtti - GCC 2.9x old ABI (Q24Foo3Bar names, __tf functions, {delta,index,pfn} vtables) and GCC 3+ Itanium ABI (_ZTV/_ZTI/_ZTS, .gnu.linkonce sections), stripped or not. Use to map classes, find virtual methods, or name constructors and vtables in a PS2 C++ game.
---

# C++ RTTI recovery

```sh
ps2re rtti GAME.ELF -o rtti.tsv
ps2re rtti GAME.ELF --functions export/functions.tsv -o rtti.tsv   # name the referencing functions
ps2re rtti GAME.ELF --strict          # only classes with a recovered vtable
```

Columns: `class mangled name_addr typeinfo ref_funcs vtables data_refs abi`

| Column | GCC 2.9x | GCC 3+ |
|---|---|---|
| `name_addr` | mangled name string | `_ZTS` string |
| `typeinfo` | static type_info `{vptr, &name}` (often empty: built at run time in .bss) | `_ZTI` object |
| `ref_funcs` | functions referencing name/type_info = the `__tf<class>` type-info function | rarely useful |
| `vtables` | data with `{0, __tf}` as slot 0 → vtable start | `{offset_to_top, &typeinfo}` → vtable start (address points must add 8) |
| `data_refs` | other data words pointing at `__tf` (engine class descriptors, RTTI base lists) | — |
| `abi` | `gcc2`, `gcc3`, `+sym` when confirmed by symbols / `.gnu.linkonce.*` names | |

## Using the results

- Virtual methods: GCC 2 vtable slots are 8 bytes `{s16 delta, s16 index,
  void *pfn}`; slot 0 is `__tf`, methods follow. GCC 3 vtables are plain
  pointers starting at vtable+8. Run `CreateDataRefFuncs.java` in Ghidra so
  every slot target becomes a function, then name them `Class::vfuncN`.
- Constructors store the vtable address into `this` (`lui/addiu` then
  `sw rX, 0(a0)` or a fixed offset): `ps2re refs GAME.ELF <vtable>` lists
  them (GCC 3: search for vtable+8).
- Class hierarchy: GCC 2 `__tf` functions call the parent's `__tf` and
  `__rtti_si`/`__rtti_class`; GCC 3 `__si_class_type_info` has the base
  type_info at +8.

## Pitfalls

- Name candidates are pattern matches; GCC 2 names with no evidence are
  kept only when Q-qualified or clearly class-like. Template names are
  shortened to `Name<...>` (arguments elided).
- On stripped ELFs without `--functions`, function starts are guessed
  from `jr ra` boundaries (`sub_XXXXXXXX`); GCC 2 vtables are still found
  (they only need the `__tf` start), but pass a Ghidra `functions.tsv` for
  reliable `ref_funcs`.