Reversing variable origin (pointer chain) in IDA. Stuck on RUNTIME_FUNCTION XREF

Question

So I have been exploring reverse engineering for the past few months and currently I am reversing a dumped executable which seems to be fully intact

I have stumbled upon something I can't seem to grasp/understand. When I reverse upwards to find out where some variable in a function originated from, I most of them time end up at RUNTIME_FUNCTION xrefs. I get stuck here since I can't go up any further.

My end goal is to find out the whole pointer chain from a static address to the target variable used in some function. I start searching upwards from a certain instruction and follow a certain variable, but unfortunately I get to the RUNTIME_FUNCTION references when I am about 3 levels deep.

I've read that runtime functions have something to do with SEH. But I couldn't find any constructed information about this RUNTIME_FUNCTION in IDA. Shouldn't some variable always lead to some static address inside the .data section? Does someone know what is happening here?

In this image you can see that when I want to figure out what references/uses this function I only get those RUNTIME_FUNCTION's:

How would you normally go around this issue to get back on track and reverse further/beyond the RUNTIME_FUNCTION?

Executable segments:

Any help is appreciated, thanks!

Answer 1

RUNTIME_FUNCTION is a system structure added by the compiler for all functions in a proper win64 executable. It is only used by the OS when processing exceptions, so it has no relation to your game's variables. You should ignore those xrefs and look elsewhere.

Answer 2

Shouldn't some variable always lead to some static address inside the .data section?

There is no concept of a variable on assembly level. We got bit-sized fields in registers and memory.

By convention, compilers designate the .data section for global and static variables. Everything inside a function is mostly handled on the stack.

How would you normally go around this issue to get back on track and reverse further/beyond the RUNTIME_FUNCTION?

Please understand that IDA does not do data flow analysis for you, but it finds cross-references. So this is not the source of the data, but something referencing to it.

What you want to do is to trace the dataflow back to its origins. Data-flow analysis looks somewhat like this:

What you should do is use your knowledge about the calling convention to know how data is passed between functions. If you can get any more specific with your question, I'm sure you will get less general answers.