1

So here is a byte sequence 45 A6 F7 in the vtable.
It points to a subroutine which is located at F7A644.
IDA expresses it as "function_symbol +1"
Why does it plus one?
Why is it 45 A6 F7 rather than 44 A6 F7?

1
  • Please edit your question and add what architecture (and, if important, what OS) this code is for. At least with the correct tags, and preferably also in the main text. – Jongware Nov 27 '16 at 18:50
8

If it is ARM architecture that may use THUMB encoding it can be result of the following issue:

If I remember correctly, calls to the virtual functions can be executed with assembly command similar to BLX as indirect jump, which allows switching between ARM and THUMB encoding. In this case this + 1 means that the target of the jump is encoded in THUMB.

See here for more information about this mechanism.

All these instructions cause a branch to label, or to the address contained in Rm. In addition:

  • The BL and BLX instructions copy the address of the next instruction into lr (r14, the link register).
  • The BX and BLX instructions can change the processor state from ARM to Thumb, or from Thumb to ARM. BLX label always changes the state. BX Rm and BLX Rm derive the target state from bit[0] of Rm:
  • if bit[0] of Rm is 0, the processor changes to, or remains in, ARM state
  • if bit[0] of Rm is 1, the processor changes to, or remains in, Thumb state.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.