I'm working on reversing a C++ application and I've come across a structure that contains a getter function that returns TypeDescriptor*
, I've read some articles on RTTI and reversing C++ but can't find a structure that matches what I'm seeing.
It seems to be a compiler generated structure because of the TypeDescriptor
getter? I'm hoping someone can point me in the right direction. There's multiple of these structures, they are in mostly contiguous but not completely as far as I can see.
Pseudo code for the struct looks like:
// These are all function pointers
class SomeClazz
{
// func1/func2 are pointers to the same function. It looks like a constructor.
void* func1(void* param1, void** param2);
void* func2(void* param1, void** param2);
// This function differs depending on the class. I believe this to be a implementation of a virtual function maybe?
virtual void handler();
// Returns a pointer to a RTTI TypeDescriptor depending on the class
TypeDescriptor* get_type_descriptor();
void get_something();
}
Here's code in the func1/2
functions in case there's a hint of what it is:
undefined ** FUN_00125860(longlong param_1,undefined **param_2)
{
undefined4 uVar1;
undefined4 uVar2;
undefined4 uVar3;
*param_2 = (undefined *)&Vftable_maybe_00589ef0;
uVar1 = *(undefined4 *)(param_1 + 0xc);
uVar2 = *(undefined4 *)(param_1 + 0x10);
uVar3 = *(undefined4 *)(param_1 + 0x14);
*(undefined4 *)(param_2 + 1) = *(undefined4 *)(param_1 + 8);
*(undefined4 *)((longlong)param_2 + 0xc) = uVar1;
*(undefined4 *)(param_2 + 2) = uVar2;
*(undefined4 *)((longlong)param_2 + 0x14) = uVar3;
return param_2;
}
Here's get_type_descriptor
:
TypeDescriptor * class::get_type_descriptor(void)
{
return &class_<lambda_88a0d3301c644a20c1df3ad0c52a86e4>_RTTI_Type_Descriptor;
}
////////////
LEA RAX, [class_<lambda_88a0d3301c644a20c1df3ad0c52 ...]
RET
Here's get_something
, not sure what the purpose is or what it's doing:
LEA RAX, [RCX+0x8]
RET
Any help/suggestions would be great. Thanks.
shared_ptr
with a custom deleter. Grep fortypeid
in MSVC<memory>
. – Rolf Rolles Dec 23 '20 at 23:45