Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a disassembly with a call to a DirectDraw->BltFast function, I encountered the following:

(*(void (__stdcall **)(LPDIRECTDRAWSURFACE7, _DWORD, _DWORD, _DWORD, _DWORD, signed int, int, int, int, int))
((void (__stdcall **)(_DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD, _DWORD))v17->lpVtbl + 7))(
*(&g_COREvidSurf + 25),

The cast has too many arguments. How does one edit the call's cast to fix the disassembly ?

EDIT: After applying a struct to the code:

.text:00540825 030                 cmp     [esp+30h+arg_8], ecx
.text:00540829 030                 mov     edx, g_COREvidSurf+64h
.text:0054082F 030                 mov     eax, g_CoreVidsurf_6
.text:00540834 030                 push    10h
.text:00540836 034                 push    0
.text:00540838 038                 push    edx
.text:00540839 03C                 push    0
.text:0054083B 040                 push    0
.text:00540844 044                 mov     ecx, [eax]
.text:00540846 044                 push    eax
.text:00540847 048                 mov     eax,[ecx+IDirectDrawSurface7Vtbl.BltFast]
.text:0054084A 048                 call    eax

and the decompilation:

v17.lpVtbl = (struct IDirectDrawSurface7::IDirectDrawSurface7Vtbl *)g_surface2;
(*(void (__stdcall **)(struct IDirectDrawSurface7::IDirectDrawSurface7Vtbl *, _DWORD, _DWORD, _DWORD, _DWORD, signed int, int, int, int, int))(*(_DWORD *)v17.lpVtbl + offsetof(IDirectDrawSurface7Vtbl, BltFast)))(
*(&g_COREvidSurf + 25),

The struct used was selected from the standard struct selection in IDA, and if i press 'Y' on the declaration of BltFast in the struct declaration, the call is declared like this:


which is correct, but as seen above, IDA is still showing too many args.

share|improve this question
up vote 3 down vote accepted

I would define a vtable struct which has the correct function pointers in it. I assume this is an IDirectDrawSurfaceX? The variable named v17->lpVtbl needs to have a type of IDirectDrawSurfaceX *. Create this structure of function pointers according to the interface definition on MSDN or load it from a standard structures if IDA has imported the DirectX C interface definitions. Set the type of the v17->lpVtbl by pressing y on the definition of lpVtbl in whatever structure type v17 is. Then you may need to force the type of the function pointer call to the type of the interface member used in the vtable. You do this by right clicking the call site and choosing Force call type.

share|improve this answer
I couldnt find any reference to "force call type". Added the struct as suggested and edited question. – user8105 Jul 20 '14 at 15:48
You need to fix whatever type v17 is so that the first member is pointer to the vtable. It looks like it's now using . notation and offsetof which shouldn't be happing. You should see v17->lpVtbl->BltFast. That is v17 is the pointer to the surface object whose first member is a pointer to the IDirectDrawSurface7 vtable and whose 7th(?) member is the pointer to the BltFast method. It looks like you made the vtable the first part of v17? You can hack around this by defining v17 as IDirectDrawSurface7 ** if you don't want to define a struct for v17. – Peter Andersson Jul 20 '14 at 16:06
yaya sorry just found "force call type" while not looking for it.That's what happens when one stares at the same code for a few months. FIXED. Thanks. – user8105 Jul 25 '14 at 5:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.