# How to make sense of the pointer in reversed function call?

I have the code below, derived from the reversed function in the original application:

``````gladius::world::World::create(*(gladius::world::World**)(*(char*)(this + 0x5e8) + 0x50));
``````

The create function looks like this:

``````void __thiscall gladius::world::World::create(World *this) {
``````

Could someone please describe the way the function is setup and may be simplify the notation above if possible?

So, this is a create function call, which takes as an argument the pointer to a particular address.

• How the pointer address is calculated in this case?
• What is the exact meaning of (this + 0x5e8) + 0x50 - 0x5e8 offset to this and then 12th element of the structure (i.e. structure of 4 bytes - address 48? )
• What 0x5e8 represents in this case (apart of being an offset, I mean what this offset could possibly point to)?

This is how it looks further in the code:

``````    this_01 = GUI::getWorld(*(GUI **)(this + 0x88));
``````

where `GUI::getWorld(*(GUI **)(this + 0x88));` points to the following function:

``````World * __thiscall gladius::gui::GUI::getWorld(GUI *this)

{
return *(World **)(*(longlong *)(this + 0x5e8) + 0x50);
}
``````

This is where the address (this + 0x5e8) + 0x50) came from.

I still don't understand the significance of these addresses, as create is a member function of World and it is called with an instance of that class as a parameter?

And the address of that instance is stored in class GUI on the address: (this + 0x5e8) + 0x50)?

Or I am confusing the above and this + 0x5e8 points to some structure in the World class, which must be somewhere at 58/4 or at 58/8 address and then within that structure I am looking at 50/4 member?

• Normally a Virtual Method this will point to the vtable and 58 is 0x58/8 or 0x58/4 11th or 22nd method of a class like foo::blah->getsomething() Aug 16 at 20:23
• Thank you for the response. What the offset of 0x50 is pointing to in this case? I mean 58 is offset to vtable and 50? Aug 17 at 6:24

Thought about this and it seems in this address `((this + 0x5e8) + 0x50)` the values are like this:
• `this + 0x5e8` - is an address of the structure in the particular class
• `0x50` - is an address of the element within that structure, could occupy any position as we don't know by just looking at it of how many other elements are there and what sizes do they have.