0

I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this:

screenshot

IDA pseudocode:

int __stdcall GameLauncher_StartGameW(int a1, int a2, int a3, int a4, int a5, int a6, int a7)
{
  return (*(int (__stdcall **)(int, int, int, int, int, int))(*(_DWORD *)a1 + 8))(a2, a3, a4, a5, a6, a7);
}

If I understand this correctly I need to get a1 object (eax) to actually get the function that I want to reverse engineer. Am I right? Is there any easy way to get this object to get the function offset?

  • it is an exported entry so the int a1 may not be available at all if you are looking statically if the function was never called from that specific dll . you may need to look at the associated Executables to see who or where this function is called from there you may eke out the argument that is passed It appears it is a vtable pointer and +8 is a method – blabb Jul 16 at 17:48
1

The easiest way would be just to set a breakpoint where the call instruction is and then perform step into - you will be redirected to the right function.

You can also check it statically assuming that you know where the GameLauncher_StartGameW is called. Notice that just before call [eax+8], eax contains *arg0 value. If you know the arguments' values, you will also get the address of the function being called.

  • Thanks! I used x64dbg and added breakpoint. I have the right function now. – Samuel Tulach Jul 17 at 8:20
  • You are welcome. – bart1e Jul 17 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.