-1

I'm studying the dll that was built for x86_64.

I study where there are links to the function "call_f1_1806F3630" and do not understand three of them. Are these features of OOP? Help me figure it out: https://disk.yandex.ru/i/crsvYi4QLBE6dQ

  1. Is this a virtual table with methods of some class?
.rdata:0000000180B8E730 BC 06 03 80 01 00 00 00       off_180B8E730   dq offset sub_1800306BC ; DATA XREF: sub_180016668+28↑o
.rdata:0000000180B8E730                                                                       ; sub_180169E2C+2E↑o ...
.rdata:0000000180B8E738 44 8D 03 80 01 00 00 00                       dq offset sub_180038D44
.rdata:0000000180B8E740 F0 8D 03 80 01 00 00 00                       dq offset sub_180038DF0
...
.rdata:0000000180B8E800 30 03 6F 80 01 00 00 00                       dq offset sub_1806F0330
.rdata:0000000180B8E808 30 36 6F 80 01 00 00 00                       [B]dq offset call_f1_1806F3630[/B]
.rdata:0000000180B8E810 20 3D 6F 80 01 00 00 00                       dq offset sub_1806F3D20
.rdata:0000000180B8E818 60 99 16 80 01 00 00 00                       dq offset sub_180169960
  1. This is not clear at all.
.rdata:0000000180EDAE60 30 36 6F 00 FF FF FF FF       stru_180EDAE60  IPtoStateMap <rva call_f1_1806F3630, -1>
.rdata:0000000180EDAE60                                                                       ; DATA XREF: .rdata:stru_180EDAE28↑o
.rdata:0000000180EDAE68 6B 36 6F 00 00 00 00 00                       IPtoStateMap <rva loc_1806F366B, 0>
.rdata:0000000180EDAE70 C4 37 6F 00 FF FF FF FF                       IPtoStateMap <rva loc_1806F37C4, -1>
.rdata:0000000180EDAE78 CB 37 6F 00 00 00 00 00                       IPtoStateMap <rva loc_1806F37CB, 0>
.rdata:0000000180EDAE80 71 93 AE 00 01 00 00 00                       IPtoStateMap <rva sub_180AE9371, 1>
.rdata:0000000180EDAE88 80 93 AE 00 00 00 00 00                       IPtoStateMap <rva loc_180AE9380, 0>
  1. This is not clear at all.
.pdata:000000018110D94C 30 36 6F 00 DA 37 6F 00 88 1C+                RUNTIME_FUNCTION <rva call_f1_1806F3630, rva algn_1806F37DA, \
.pdata:000000018110D94C D0 00                                                           rva stru_180D01C88>
0

The first one is a function pointer in a virtual function table. The second two are x64 exception metadata included by the compiler.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.