10

This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info.

  • Is this something standard? (Is this RTTI)
  • If so, how is this called?
  • Are there plugins/tools to help with this?

IDA Screenshot of debug info

14

It has the fingerprint of an assert:

  1. it's called directly after a test;
  2. it uses a number -- probably a source line number --, a string which points to a file name -- the source file -- and a string that describes an error condition;
  3. it does not return. (Can be inferred because the inspected value would lead to an erronous situation if the called function returned.)

assert is a standard function in most (if not outright all!) standard libraries, and so if your decompiler could recognize which compiler was used, it would have assigned a standard label to sub_6E0D40. Since it didn't, you could trace that address and see if (a) it jumps immediately to an external routine such as Windows' native Assert, or (b) does what an assert does: outputting the error and immediately exiting.


Addition: using the stack plus registers ecx and edx seem to indicate this sub is declared "Microsoft __fastcall" (wikipedia).

  • 1
    sub_6E0D40 is __fastcall, not __stdcall. See en.wikipedia.org/wiki/… – Jason Geffner Oct 9 '13 at 20:48
  • @JasonGeffner: you're right, my (wrong) ref said ecx and edx are "designated for use within the function", which is quite the opposite. Edited. – usr2564301 Oct 9 '13 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.