The C++ spec doesn't even require the implementation to use a vtable AFAIK. With that behind, how hard is it to dump the binary representation of a class and figure out where the pointer is?