I am using Ghidra to reverse enigneer a PE file, and I found a lot of function calls that look like this: (**(code **)(*(longlong *) inBunch + 0x30))(inBunch, local_res18, 4); I am very confused, because most function calls are normal. What does this mean? I understand that it's calling some function on the inBunch variable, but how do I find out what function actually lives at offset 0x30?

  • that it because it seems like a function pointer
    – R4444
    Jan 9 at 22:10
  • When and how is isBunch initialized? It's likely that it is an object of some kind, and the line you pointed out is calling one of its methods.
    – K. Jiang
    Jan 10 at 20:49


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.