How can I find the real function that *(_DWORD *)v2 + 24) point to?

(*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4);

int __fastcall sub_1(int a1, int a2)
  int v2; // r4@1
  int v3; // r5@1
  int v4; // r6@1
  int v5; // r0@2
  int v6; // r0@2
  unsigned int v7; // r0@4
  int v8; // r5@8

  v2 = a2;
  v3 = a1;
  v4 = *(_BYTE *)(sub_3(*(_DWORD *)(v3 + 1684)) + 13);
  (*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4);
  if ( v4 )
    (*(void (__fastcall **)(int, _DWORD))(*(_DWORD *)v2 + 56))(v2, *(_DWORD 
  • Inside the function, the address of the function you are looking for is v2 + sizeof(*_DWORD)*24. This typically means: v2+0x60 on a 32-bit program where a pointer size is 4 bytes, and double that in a 64-bit system. v2 = a2, which is the second int passed to sub_1, probably in register EDX, because it is a __fastcall type func. The first line of your code also calls a function pointer, but I cannot see which scope it belongs to. – Yotamz Mar 25 at 13:31
  • its address is in the a2 variable – SSpoke Mar 25 at 22:53

A __fastcall function gets its first two arguments in ECX and EDX. int __fastcall sub_1(int a1, int a2) { int v2; v2 = a2; //v2 = EDX ... This line may change the address pointed to by a2, if it happens to be a pointer, but not the value of a2 itself. However, after this line EDX may have changed:


In this line:

(*(void (__fastcall **)(int, int))(*(_DWORD *)v2 + 24))(v2, v4);

the relevant part is:

(*(_DWORD *)v2 + 24))

v2 is treated as a _DWORD pointer, which means its size is that of a pointer, typically 4 bytes. So, v2+24, treated as a pointer-sized variable is v2+24*4. This value is then dereferenced and treated as function pointer.

The function address is the _DWORD value found at [v2+0x60]

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.