0
v5 = (*(int (__cdecl **)(int))((char *)&etext + 1))(a1);

Please explain me what does this line mean (if possible, please write from what it was compiled from (language - c))

3

It's just a convoluted function call via function pointers.

(*(int (__cdecl **)(int))

casts a given number to a pointer to a function pointer (note the ** so second degree function pointer) and dereferences it so you end up with a regular function pointer. The calling convention in use being cdecl. The target function would look like:

int __cdecl do_something(int some_arg) { ... }

The number being cast and dereferenced then is the address of etext plus 1. So at etext + 1 is an address, that points to another address that points to a function.

That function then is called with a5 as the argument, storing the return value in v5.

If I had to make up a C snippet, it would be something like this, the last line being what you posted:

typedef int (_cdecl *fptr2)(int);    //first degree function pointer typedef
typedef int (_cdecl **fptr1)(int);   //second degree function pointer typedef

int _cdecl do_something(int arg)
{
    return arg+5;
}

void main()
{
    struct
    {
        char unused;             //this is for the etext + 1
        fptr2 pp_func;           //stores a fptr to a fptr
    } etext;

    fptr1 func = &do_something;  //first degree function pointer
    etext.pp_func = &func;       //second degree function pointer
    (*etext.pp_func)(1337);      //the actual call and the equivalent of your line
}

A more real-world example would probably be etext+1 storing a pointer to a list of function pointers. Outside of that I rarely see second degree function pointers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.