0

I have the code below, derived from the reversed function in the original application:

gladius::world::World::create(*(gladius::world::World**)(*(char*)(this + 0x5e8) + 0x50));

The create function looks like this:

void __thiscall gladius::world::World::create(World *this) {

Could someone please describe the way the function is setup and may be simplify the notation above if possible?

So, this is a create function call, which takes as an argument the pointer to a particular address.

  • How the pointer address is calculated in this case?
  • What is the exact meaning of (this + 0x5e8) + 0x50 - 0x5e8 offset to this and then 12th element of the structure (i.e. structure of 4 bytes - address 48? )
  • What 0x5e8 represents in this case (apart of being an offset, I mean what this offset could possibly point to)?

This is how it looks further in the code:

    this_01 = GUI::getWorld(*(GUI **)(this + 0x88));
    gladius::world::World::create(this_01);

where GUI::getWorld(*(GUI **)(this + 0x88)); points to the following function:

World * __thiscall gladius::gui::GUI::getWorld(GUI *this)

{
  return *(World **)(*(longlong *)(this + 0x5e8) + 0x50);
}

This is where the address (this + 0x5e8) + 0x50) came from.

I still don't understand the significance of these addresses, as create is a member function of World and it is called with an instance of that class as a parameter?

And the address of that instance is stored in class GUI on the address: (this + 0x5e8) + 0x50)?

Or I am confusing the above and this + 0x5e8 points to some structure in the World class, which must be somewhere at 58/4 or at 58/8 address and then within that structure I am looking at 50/4 member?

2
  • Normally a Virtual Method this will point to the vtable and 58 is 0x58/8 or 0x58/4 11th or 22nd method of a class like foo::blah->getsomething()
    – blabb
    Commented Aug 16, 2021 at 20:23
  • Thank you for the response. What the offset of 0x50 is pointing to in this case? I mean 58 is offset to vtable and 50?
    – Irbis77
    Commented Aug 17, 2021 at 6:24

1 Answer 1

0

Thought about this and it seems in this address ((this + 0x5e8) + 0x50) the values are like this:

  • this + 0x5e8 - is an address of the structure in the particular class

  • 0x50 - is an address of the element within that structure, could occupy any position as we don't know by just looking at it of how many other elements are there and what sizes do they have.

Just didn't realise that this is what blabb said in the comment. Happy to accept that comment as an answer if you want to post it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.