I am reverse engineering some code from which IDA has generated the following disassembly. These specific lines of code are just for illustrative purposes. Notice that the third line does not call a specifc function by its name but rather by its address.
mov rcx, [rsp+128h+var_D8] // reg CX gets the address at stack pointer+128h+var_D8 bytes mov r8, [rcx] // the address at reg CX is stored to reg r8 call qword ptr [r8 + 18h] // at address rax+18h, call function defined by qword bytes
I'm interested in determining which function is being called. What mechanisms, tools, tricks, etc. can I use to determine which function in the dissassembly a call
qword ptr <address> is referring to? I'm up for trying other disassembler programs.
From an answer to my previous question, this is known as an "indirect call" or (perhaps a "virtual function call"). The disassembly has many of these, so how do I resolve them? In addition, IDA has identified hundreds of functions. How do I go about figuring out which one was actually being called during any given indirect call (or virtual call)?