Very nice. As a follow up would be interesting to also reverse engineer the structure of the vtable itself. I guess it’s a list of pointers to the method implementations?

Not just pointers, it also has info such as alignment. (Shameless plug) I wrote a relevant article recently: https://ashdnazg.github.io/articles/26/Downcasting-Arcs-in-R...

Awesome, thank you for sharing!