An incomprehensible line in the output from hex rays

Question

v5 = (*(int (__cdecl **)(int))((char *)&etext + 1))(a1);

Please explain me what does this line mean (if possible, please write from what it was compiled from (language - c))

Answer 1

It's just a convoluted function call via function pointers.

(*(int (__cdecl **)(int))

casts a given number to a pointer to a function pointer (note the ** so second degree function pointer) and dereferences it so you end up with a regular function pointer. The calling convention in use being cdecl. The target function would look like:

int __cdecl do_something(int some_arg) { ... }

The number being cast and dereferenced then is the address of etext plus 1. So at etext + 1 is an address, that points to another address that points to a function.

That function then is called with a5 as the argument, storing the return value in v5.

If I had to make up a C snippet, it would be something like this, the last line being what you posted:

typedef int (_cdecl *fptr2)(int);    //first degree function pointer typedef
typedef int (_cdecl **fptr1)(int);   //second degree function pointer typedef

int _cdecl do_something(int arg)
{
    return arg+5;
}

void main()
{
    struct
    {
        char unused;             //this is for the etext + 1
        fptr2 pp_func;           //stores a fptr to a fptr
    } etext;

    fptr1 func = &do_something;  //first degree function pointer
    etext.pp_func = &func;       //second degree function pointer
    (*etext.pp_func)(1337);      //the actual call and the equivalent of your line
}

A more real-world example would probably be etext+1 storing a pointer to a list of function pointers. Outside of that I rarely see second degree function pointers.