private static List<Address> getRefsToRtti0(Program program, List<MemoryBlock> dataBlocks,
			List<Address> rtti0Locations, DataValidationOptions validationOptions,
			TaskMonitor monitor) throws CancelledException {

		List<Address> addresses = new ArrayList<>(); // the RTTI 4 addresses

		int rtti0PointerOffset = Rtti4Model.getRtti0PointerComponentOffset();

		MemoryBytePatternSearcher searcher = new MemoryBytePatternSearcher("RTTI0 references");

		for (Address rtti0Address : rtti0Locations) {
			byte[] bytes;
			if (MSDataTypeUtils.is64Bit(program)) {
				// 64-bit programs will have the addresses as offsets from the image base (BOS)
				bytes = ProgramMemoryUtil.getImageBaseOffsets32Bytes(program, 4, rtti0Address);

				addByteSearchPattern(searcher, validationOptions, addresses, rtti0PointerOffset,
					rtti0Address, bytes);
			}
			else {
				// 32-bit could have direct address in memory
				bytes = ProgramMemoryUtil.getDirectAddressBytes(program, rtti0Address);

				addByteSearchPattern(searcher, validationOptions, addresses, rtti0PointerOffset,
					rtti0Address, bytes);
			}
		}

		AddressSet searchSet = new AddressSet();
		for (MemoryBlock block : dataBlocks) {
			searchSet.add(block.getStart(), block.getEnd());
		}

		searcher.search(program, searchSet, monitor);

		return addresses;
	}
For each of the RTTI0 locations found locate the associated RTTI4 structure referring to it.

@param program program to be searched
@param dataBlocks dataBlocks to search
@param rtti0Locations list of known rtti0 locations
@param validationOptions options for validation of found RTTI4 entries
@param monitor to cancel
@return list of found RTTI4 references to known RTTI0 locations
@throws CancelledException if canceled
Ghidra/Features/MicrosoftCodeAnalyzer/src/main/java/ghidra/app/plugin/prototype/MicrosoftCodeAnalyzerPlugin/RttiAnalyzer.java