2

I'm trying to reverse-engineer a binary. I'm interested to find its network traffic but dynamic analysis is failing. Using IDA I'm able to identify network calls but when I try to reverse its caller using x shortcut after couple of callers I get stuck at this point:

.text:00407230                 dd offset sub_40600C
.text:00407234                 dd offset sub_403C30
.text:00407238                 dd offset nullsub_4
.text:0040723C                 dd offset sub_40601C
.text:00407240                 dd offset sub_4039BC
.text:00407244                 dd offset sub_40C294

I would like to ask how I can proceed further.

3

This means that these functions are called indirectly (if ever called at all). If this program is written in something like C++ this may be a virtual function pointer table, and anyway such code organization usually represents table of functions used by indirect calls.

If this program is written in C++ I'd suggest to read this presentation by @Igor Skochinsky - this is very educational reading.

I'd proceed as follows:

  • Find a references to the specific address where function address is stored.
  • If there is no one referencing it look for the first address before the one you are working with referenced by something and inspect all references to it.
  • You'll probably find there indirect call of one of the functions from the table or initialization of virtual function pointer table in the instance of the class.
  • Thank you. I've read the presentation and it is very helpful. I'll try to dig more into it. – Umer May 19 '16 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.