 <p>Well, actually you can. I don't care about portability, but in VS you can do it. Assuming that we are building 32-bit code with VS, the first 4 bytes at the objects address is the vtable address. By looking at the header files we know the order of methods in the vtable.</p> <p>Example:</p> <pre><code>class Base { public: virtual void printMessage() { std::cout &lt;&lt; "Base::printMessage()" &lt;&lt; std::endl; } }; class Derived : public Base { public: void printMessage() { std::cout &lt;&lt; "Derived::printMessage()" &lt;&lt; std::endl; } }; int main(int argc, char* argv[]) { Derived d; unsigned int vtblAddress = *(unsigned int*)&amp;d; typedef void(*pFun)(void*); pFun printFun = (pFun)(*(unsigned int*)(vtblAddress)); printFun(&amp;d); return 0; } </code></pre> <p>P.S. I'm not going to ask why are you doing it, but here you have one option :-)</p>