Using gdb with the core file:
Check with radare2 :
(gdb) x/10gx 0x6020a0 Shows 0x401456 in the vtable slot – that’s the secret function address! Bad Memories -v0.9- -recreation-