Skyrim RE · ground floor

What Is Actually
In Memory

Every confusion between pointers, offsets, vtables and RTTI comes from one slip: mixing up an address with the thing sitting at that address. Fix that once and the rest falls out.

01 · THE ONLY REAL THING

Memory is a numbered street

One long row of bytes. Each has a number — its address. What lives there is a separate question entirely. Click a row.

addressraw byteswhat lives there

Every row has an address. Only the address column is the address. Everything right of it is contents.

02 · OFFSET

An offset is not an address. It is a distance.

Useless alone. It becomes an address only when added to a base. Drag both and watch the landing spot move.

+ =

03 · POINTER vs VTABLE

Counting the hops

This is the step that gets collapsed. A direct call is one hop. A virtual call is two, and the second one is only decided at runtime.

04 · WHY THE NAMES SURVIVED

vtable and RTTI sit next to each other

Two different structures, always neighbours, and the reason Ghidra could recover MapMenu but never the method name.

vtable — function pointers

  • An array of addresses, one per virtual method.
  • Slot order is the class layout. Slot 7 is always the same method for that class.
  • Pure numbers. Carries no names at all.
  • Not a function, so Ghidra emits no symbol — this is why vtables are missing from symbols-*.txt.
VTABLE_Compass[0] = 0x1418F8060
AE id 215380 · SE id 268825

RTTI — the name tag

  • A small record next to the vtable holding the literal string "MapMenu".
  • Exists so C++ can do dynamic_cast and typeid at runtime.
  • Bethesda shipped it, so class names survived in a stripped binary.
  • It names the class only. Method names were never stored anywhere.
RTTI_Compass
AE id 396693 · SE id 688841

the consequence

Ghidra sees a function in MapMenu's vtable, reads the RTTI string beside it, and names it MapMenu::sub. The class half is real — recovered from bytes actually in the binary. The ::sub half means "unnamed" — a placeholder, not information. Roughly 77% of these functions never got further than that, which is the entire reason CommonLib's hand-curated names matter.

05 · CHECK YOURSELF

Five that catch people

Answer before revealing. A wrong guess here is cheaper than a wrong guess in a hook.

Address = where. Contents = what. Never the same question.

An offset is a distance. It becomes an address only when something supplies the base.

A pointer is a cell whose contents happen to be an address. Following it is a hop, and hops must be counted, never assumed.

A vtable holds addresses and no names. RTTI holds the class name and no addresses. You need both to say what a function is.