I'm reversing some old game (for fun, to restore its priceless rules). It's been most probably linked statically to MSVCRT, some very old version. Also it uses heavily WinAPI (like ODCBC drivers, crypto libs, multi-threading and network stuff). So far I found one very weird class:


What can I see from reversed code, it's a base class for some other structures, and it uses some synchronization constructions.

Unfortunately, I couldn't find any info about those DNameNodes. Do you have any ideas, what's are they used for?

Guessed c.tor of some of (guessed) derived class:

DNameNode *__thiscall sub_4182BD(DNameNode *this)
  DNameNode *v1; // ST00_4@1

  v1 = this;
  *(_DWORD *)v1 = &off_45F538;
  *((_DWORD *)v1 + 3) = -1;
  *((_DWORD *)v1 + 2) = 0;
  return v1;

1 Answer 1


Okay, now I'm pretty sure, that it was FLIRT signature missmatch. DNameNode from my code doesn't have anything common with undname tool (which looks like IDA missmatches it with).

Also, I found in Google, that this structure is present in WoW, Diablo2 and Lineage clients.

So, it's a structure with 1 sizeof(ptr) field and 4 structures. In my case it was kind of smart pointer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.