0

I'm reverse engineering a game and came across some function calls like the ones shown below, how do I find where these functions are located / decompile them?

(*(BaseClient->int640 + 304))(BaseClient)

(*(BaseClient->int640 + 224))(BaseClient, *&v32->gap2[262], &v116, *&v32->gap2[342], v34, v33, v146, *&v32->gap2[246], &Mem, 0)

2 1

Improve this question
1
  • Sometimes it helps to dump the game in the middle of it being fully active, as the full content of the resource segment may not be in memory otherwise. You can also find a reference to free (often called indirectly by a function in the game itself) and look at the xrefs to the xrefs (to the xrefs) searching for functions that are called by something in the resource segment -- usually the destructor which is the first vtable entry. There is also the Class Informer plugin, though that can certainly miss some of the vtables.
    – Orwellophile
    Apr 25, 2021 at 6:50

1 Answer 1

Reset to default
1

By finding the constructor for the structure type that you're looking at, making note of the VTable address, and adding the indicated offsets to obtain the concrete function pointers for the calls in question.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.