This is related to my previous question, regarding pulling objects from a dmp file.

As I mentioned in the previous question, I can successfully pull object out of the dmp file by creating wrapper 'remote' objects. I have implemented several of these so far, and it seems to be working well. However I have run into a snag.

In one case, a pointer is stored in a class, say of type 'SomeBaseClass', but that object is actually of the type 'SomeDerivedClass' which derives from 'SomeBaseClass'. For example it would be something like this:

MyApplication!SomeObject
   +0x000 field1            : Ptr32 SomeBaseClass
   +0x004 field2            : Ptr32 SomeOtherClass
   +0x008 field3            : Ptr32 SomeOtherClass

I need someway to find out what the ACTUAL type of 'field1' is.

To be more specific, using example addresses:

MyApplication!SomeObject
   +0x000 field1            : 0cae2e24 SomeBaseClass
   +0x004 field2            : 0x262c8d3c SomeOtherClass
   +0x008 field3            : 0x262c8d3c SomeOtherClass

0:000> dt SomeBaseClass 0cae2e24 
MyApplication!SomeBaseClass
   +0x000 __VFN_table : 0x02de89e4 
   +0x038 basefield1         : (null) 
   +0x03c basefield2        : 3

0:000> dt SomeDerivedClass 0cae2e24 
MyApplication!SomeDerivedClass
   +0x000 __VFN_table : 0x02de89e4 
   +0x038 basefield1        : (null) 
   +0x03c basefield2        : 3
   +0x040 derivedfield1     : 357
   +0x044 derivedfield2     : timecode_t

When I am in WinDbg, I can do this:

dt 0x02de89e4 

And it will show the type:

0:000> dt 0x02de89e4 
SomeDerivedClass::`vftable'
Symbol  not found.

But how do get that inside an extension? Can I use SearchMemory() to look for 'SomeDerivedClass::`vftable'? If you follow my other question, I need this type information so I know what type of wrapper remote classes to create. I figure it might end up being some sort of case-statement, where I have to match a string to a type? I am ok with that, but I still don't know where I can get that string that represents the type of the object in question (ie SomeObject->field1 in the above example).