3

This is probably a stupid question.

Imagine our dissassembled function takes 1 parameter, for example "unsigned short *"

However, in c++ this could be a BSTR, or something else...what is the best way to figure out the type of input that is expected?

Right now I am just making educated guesses..but there must be a better way? (Or if someone can point me to good books/resources covering this)

  • Do a web search for "reverse engineering type inference" – fpmurphy Jul 2 '16 at 11:28
  • I was about to recommend you "do an educated guess", until I read this is what you do. This is what, personally, I do. There is no other way, I think. You need to reverse engineer a number of callees and callers to determine its type. – joxeankoret Jul 5 '16 at 17:14
2

To figure out the type of a function parameter, you could reverse engineer the caller to see where the input parameter is coming from and how it's instantiated (potentially needing to go up a few levels in the call stack), and/or you could reverse engineer the callee to see how it handles the parameter.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.