0

I'm reverse engineering a piece of code that has hundreds of calls to a couple of functions I'm not exactly sure what they are doing but looks like standard library functions that do some byte reading?

They are as I currently call them read8 and read16 and show in IDA Pro as pseudocode:

int __cdecl read8(int a1)
{
  return *(_DWORD *)(a1 + 8);
}

int __cdecl read16(int a1)
{
  return *(_DWORD *)(a1 + 16);
}

So given a pointer a1 do they read a single DWORD positioned as the 8th and 16th DWORD after the initial address of a1?

Improve this question

1 Answer 1

Reset to default
1

So given a pointer a1 do they read a single DWORD positioned as the 8th and 16th DWORD after the initial address of a1?

No, they read a single DWORD positioned 8-bytes and 16-bytes (respectively) after the initial address of a1.

In C, this might look as follows:

typedef struct _S
{
    DWORD a;
    DWORD b;
    DWORD c;
    DWORD d;
    DWORD e;
} S;

S x;
DWORD c = read8(&x);
DWORD e = read16(&x);
Improve this answer
3
  • I thought this was supposed to be pointer arithmetic where +8 means 8 memory allocation slots for a pointer instead of single byte positions?
    – Roberto Andrade
    Commented Nov 6, 2015 at 16:13
  • What about the * before the first set of parenthesys, is that not dereferencing the contents in position +4 as an actual memory address and looking at that address instead to return?
    – Roberto Andrade
    Commented Nov 6, 2015 at 16:41
  • In your decompilation, a1 is an int, and adding to an int doesn't take value type sizes into account. Further questions about interpreting C code should probably be posted to stackoverflow.com instead of here.
    – Jason Geffner
    Commented Nov 6, 2015 at 16:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.