I am a bit of a starter, so bear with me as I can't find the answer through Google (a common thing in Ghidra work I noticed so far).
I have a function that seems to read like it is a Constructor. But I am having trouble what it is doing, mainly because I think I don't understand the C language that well.
The code I am confused about is this:
The code as C:
The code as ASM:
Sorry for using screenshots, I couldn't get the ASM to reasonably copy and paste into here.
*param_1
, is set to a specific address. What this * in front of the variable means, I can't really find besides people saying "You shouldn't do that in C code!"
What it then starts doing is nulling out some variables in an array or struct that param_1
apparently is now (going by the ASM, param_1 == ECX
and so probably _this_
?) the rest seems irrelevant for now.
What is at 0x497e68
? It is an address, that then points towards another bit of code at 0x438170
. And while this 0x497e68
address is references 4 times, all of them do so in a similar manner, and thus I never see a direct "CALL" to this indirect method. The method itself is simply calling _free on ECX. It's not special.
So what is going on here? Is there a reasonable explanation as to why this is happening? And what should I actually be reading here? And if so, is there then a way I can convince Ghidra to present this in a more sensible way?
C++
rather thanC
.0x497e68
is the address of the virtual function table or vtable. This is an array of function pointers.*param_1
is the same asparam_1[0]
and is set of the address of the vtable.