I am a bit of a starter, so bear with me as I can't find the answer through Google (a common thing in Ghidra work I noticed so far).

I have a function that seems to read like it is a Constructor. But I am having trouble what it is doing, mainly because I think I don't understand the C language that well.

The code I am confused about is this:

The code as C:

The code as C

The code as ASM:

The code as ASM

Sorry for using screenshots, I couldn't get the ASM to reasonably copy and paste into here.

*param_1, is set to a specific address. What this * in front of the variable means, I can't really find besides people saying "You shouldn't do that in C code!"

What it then starts doing is nulling out some variables in an array or struct that param_1 apparently is now (going by the ASM, param_1 == ECX and so probably _this_?) the rest seems irrelevant for now.

What is at 0x497e68? It is an address, that then points towards another bit of code at 0x438170. And while this 0x497e68 address is references 4 times, all of them do so in a similar manner, and thus I never see a direct "CALL" to this indirect method. The method itself is simply calling _free on ECX. It's not special.

So what is going on here? Is there a reasonable explanation as to why this is happening? And what should I actually be reading here? And if so, is there then a way I can convince Ghidra to present this in a more sensible way?

  • it is like int bar = 5: . int* myintarr [4]={ &bar,null,null,null};
    – blabb
    Nov 14, 2021 at 5:30
  • 2
    You are probably looking at code that was originally C++ rather than C. 0x497e68 is the address of the virtual function table or vtable. This is an array of function pointers. *param_1 is the same as param_1[0] and is set of the address of the vtable.
    – Ian Cook
    Nov 14, 2021 at 11:46


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.