0

I'm reversing some old game (for fun, to restore its priceless rules). It's been most probably linked statically to MSVCRT, some very old version. Also it uses heavily WinAPI (like ODCBC drivers, crypto libs, multi-threading and network stuff). So far I found one very weird class:

DNameNode 

What can I see from reversed code, it's a base class for some other structures, and it uses some synchronization constructions.

Unfortunately, I couldn't find any info about those DNameNodes. Do you have any ideas, what's are they used for?

Guessed c.tor of some of (guessed) derived class:

DNameNode *__thiscall sub_4182BD(DNameNode *this)
{
  DNameNode *v1; // ST00_4@1

  v1 = this;
  DNameNode::DNameNode(this);
  *(_DWORD *)v1 = &off_45F538;
  *((_DWORD *)v1 + 3) = -1;
  *((_DWORD *)v1 + 2) = 0;
  return v1;
}
1

Okay, now I'm pretty sure, that it was FLIRT signature missmatch. DNameNode from my code doesn't have anything common with undname tool (which looks like IDA missmatches it with).

Also, I found in Google, that this structure is present in WoW, Diablo2 and Lineage clients.

So, it's a structure with 1 sizeof(ptr) field and 4 structures. In my case it was kind of smart pointer.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.