So I have been exploring reverse engineering for the past few months and currently I am reversing a dumped executable which seems to be fully intact
I have stumbled upon something I can't seem to grasp/understand. When I reverse upwards to find out where some variable in a function originated from, I most of them time end up at
RUNTIME_FUNCTION xrefs. I get stuck here since I can't go up any further.
My end goal is to find out the whole pointer chain from a static address to the target variable used in some function. I start searching upwards from a certain instruction and follow a certain variable, but unfortunately I get to the
RUNTIME_FUNCTION references when I am about 3 levels deep.
I've read that runtime functions have something to do with SEH. But I couldn't find any constructed information about this RUNTIME_FUNCTION in IDA. Shouldn't some variable always lead to some static address inside the .data section? Does someone know what is happening here?
How would you normally go around this issue to get back on track and reverse further/beyond the RUNTIME_FUNCTION?
Any help is appreciated, thanks!