0

I am reversing a class, which has RTTI information. It has 2 virtual functions in its vftable, and in IDA Pro I can see some kind of zero terminated strings below the last vfunction. Here's how it looks like:

.rdata:00007FF6EF4FB598 ; class BSTValueEventSource<ViewCasterUpdateEvent>: BSTEventSink<BSTValueRequestEvent<ViewCasterUpdateEvent> >;   (#classinformer)
.rdata:00007FF6EF4FB598                 dq offset ??_R4?$BSTValueEventSource@VViewCasterUpdateEvent@@@@6B@ ; const BSTValueEventSource<ViewCasterUpdateEvent>::`RTTI Complete Object Locator'
.rdata:00007FF6EF4FB5A0 ; const BSTValueEventSource<class ViewCasterUpdateEvent>::`vftable'
.rdata:00007FF6EF4FB5A0 ??_7?$BSTValueEventSource@VViewCasterUpdateEvent@@@@6B@ dq offset sub_7FF6ED1A39F0
.rdata:00007FF6EF4FB5A0                                         ; DATA XREF: sub_7FF6ED19DC00:loc_7FF6ED19DC13↑o
.rdata:00007FF6EF4FB5A0                                         ; sub_7FF6ED19E180:loc_7FF6ED19E263↑o ...
.rdata:00007FF6EF4FB5A8                 dq offset sub_7FF6ED1A4560 ; //
.rdata:00007FF6EF4FB5B0 aTtcastray      db 'TtCastRay',0        ; DATA XREF: sub_7FF6ED19E2D0+AF9↑o
.rdata:00007FF6EF4FB5B0                                         ; sub_7FF6ED1A4F80+48↑o ...
.rdata:00007FF6EF4FB5BA                 align 20h
.rdata:00007FF6EF4FB5C0 aBusefuzzypicki db 'bUseFuzzyPicking:Interface',0
.rdata:00007FF6EF4FB5C0                                         ; DATA XREF: .data:00007FF6EFF50D68↓o
.rdata:00007FF6EF4FB5DB                 align 20h
.rdata:00007FF6EF4FB5E0 aFactivatepickr db 'fActivatePickRadius:Interface',0
.rdata:00007FF6EF4FB5E0                                         ; DATA XREF: .data:00007FF6EFF50D80↓o
.rdata:00007FF6EF4FB5FE                 align 20h
.rdata:00007FF6EF4FB600 aFactivatepickl db 'fActivatePickLength:Interface',0
.rdata:00007FF6EF4FB600                                         ; DATA XREF: .data:00007FF6EFF50D98↓o
.rdata:00007FF6EF4FB61E                 align 20h
.rdata:00007FF6EF4FB620 aFlargeactivate db 'fLargeActivatePickLength_G:Interface',0
.rdata:00007FF6EF4FB620                                         ; DATA XREF: .data:00007FF6EFF50DB0↓o
.rdata:00007FF6EF4FB645                 align 8
...

It seems that those strings can provide some useful information, but all the sources on RTTI I read didn't have anything that could explain them.

What could those strings be?

Improve this question
2
  • 2
    But they are cross-referenced, so IDA helpfully indicates they are used somewhere else. What do those XREF's point to?
    – Jongware
    Commented Jul 22, 2018 at 13:07
  • @usr2564301 I don't know why I haven't checked the XREF's. One of the XREF's is referenced from a place related to a class SettingT<INISettingCollection>. So it seems those string have to do with the settings in INI, and are not related to RTTI.
    – dchrome
    Commented Jul 22, 2018 at 15:59

1 Answer 1

Reset to default
2

As usr2564301 suggested, I checked the XREF's provided by IDA. They pointed to a class SettingT<INISettingCollection>.

It looks like those string have nothing to do with RTTI and are related to settings in an INI file.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.