1

I'm reversing a Delphi program and have a part where it says:

Result = *(Self - 44);

But I want it to say something like:

Result = *(Self - offsetof(VMT_ClassDefinition, vmtClassName));

Being VMT_ClassDefinition the following struct:

struct VMT_ClassDefinition {
    Cardinal vmtSelfPtr;
    Cardinal vmtIntfTable;
    Cardinal vmtAutoTable;
    Cardinal vmtInitTable;
    Cardinal vmtTypeInfo;
    Cardinal vmtFieldTable;
    Cardinal vmtMethodTable;
    Cardinal vmtDynamicTable;
    Cardinal vmtClassName;
    Cardinal vmtInstanceSize;
    Cardinal vmtParent;
    Cardinal vmtSafeCallException;
    Cardinal vmtAfterConstruction;
    Cardinal vmtBeforeDestruction;
    Cardinal vmtDispatch;
    Cardinal vmtDefaultHandler;
    Cardinal vmtNewInstance;
    Cardinal vmtFreeInstance;
    Cardinal vmtDestroy;
};

Where cardinal is unsigned int. The problem is that after using "Right Click > Struct offset" on top of the number 44 it generates the following result:

Result = *(Self - offsetof(VMT_ClassDefinition, vmtSafeCallException));

I was doing what is said in New features in Hex-Rays Decompiler 1.6 section 3, but as you can see the expected result and what I got is totally different.

My guess is that it forgets about the "-" sign and just advances from the start +44. Is there a way to reverse this behavior? I know it can be done in ASM view by inverting with "_" and then pressing "T" like in Negated structure offsets, but that does not apply to the Pseudocode view.

2 Answers 2

1

Shifted pointer should work, I think.

1

Since there seems to be no other way I ended up converting the Self variable into a pointer to the struct and IDA generated the following code:

Self[-1].vmtClassName

At least it is readable now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.