I have a simple C++ program compiled with Visual Studio 2005. I know that this program has a class
base with a member variable
How can I identify the variable x when looking at the x86? Here is a function of this binary.
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
For Visual Studio, ecx usually points to the current this object. As you can see, it's placed in esi at the start of your program.
.text:1090B641 mov esi, ecx
esi is not modified elsewhere, and is always used to access variables with offsets. That should indicate to you that it's the address of a struct, and each offset points to a given variable.
.text:1090B651 mov dword ptr [esi], offset off_10959BE4
.text:1090B660 mov [esi+1Ch], eax
.text:1090B663 mov [esi+10h], eax
.text:1090B666 mov [esi+3Ch], ebx
.text:1090B669 mov [esi+38h], ebx
.text:1090B66C mov [esi+40h], ebx
.text:1090B66F mov byte ptr [esi+44h], 0ACh
You'll have to find the purpose of each of those variables by looking at their size and how they are used in your program. In order to help you with that, you can define a new struct in Ida by going in the Structs tab (Shift+F9), and defining a new struct with variables corresponding to those offsets. You can then map them with T to help you following them.
See for instance this blog post.