I am new to reverse engineering, really new, I am able to reverse engineer vtables and getting function indices for each of them (with the help of the original SDK of the software that I work with), but I am not sure how does one reverse engineer structure, are there any tips specifically regarding reverse engineering structures or I would have to learn way more than I already do in order to do that.

So far I have gotten function to hook from vtable with the following hierarchy

void __fastcall RenderView(someStructure& structure1, someStructure& structure2, int int1, int int2)
     oRenderView(structure1, structure2, int1, int2);

Highlighted function in vtable:

Highlighted function in vtable

Pseudocode of the same function:

Pseudocode of the same function

I need to get the contents of the someStructure (it has a different name but that doesn't matter), as I mentioned early, the software I work with has an SDK but that's outdated but I have an idea on how this structure would look like, I just have no idea on how to get.

  • From the pseudocode, it looks like a virtual table or a class. For vtable, the first argument is this i.e. pointer of the current class instance. – Biswapriyo Sep 15 '20 at 20:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.