I have a simple C++ program compiled with Visual Studio 2005. I know that this program has a class base with a member variable x.
How can I identify the variable x when looking at the x86? Here is a function of this binary.
-
Do you know the language in which this program was written?– user2823000Dec 4, 2015 at 21:36
-
@Dillinur yes its C++ visual studio 2005, but i dont have any additional info like pdb or Coff, here is the source - pseudo code pastebin.com/5NLDV3S1 , asm pastebin.com/GRuJWSm6– LighFusionDec 4, 2015 at 21:41
Add a comment
|
1 Answer
For Visual Studio, ecx usually points to the current this object. As you can see, it's placed in esi at the start of your program.
.text:1090B641 mov esi, ecx
esi is not modified elsewhere, and is always used to access variables with offsets. That should indicate to you that it's the address of a struct, and each offset points to a given variable.
.text:1090B651 mov dword ptr [esi], offset off_10959BE4
.text:1090B660 mov [esi+1Ch], eax
.text:1090B663 mov [esi+10h], eax
.text:1090B666 mov [esi+3Ch], ebx
.text:1090B669 mov [esi+38h], ebx
.text:1090B66C mov [esi+40h], ebx
.text:1090B66F mov byte ptr [esi+44h], 0ACh
You'll have to find the purpose of each of those variables by looking at their size and how they are used in your program. In order to help you with that, you can define a new struct in Ida by going in the Structs tab (Shift+F9), and defining a new struct with variables corresponding to those offsets. You can then map them with T to help you following them.
See for instance this blog post.
