0

I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I have found the constructor call for an important class and now need to know how large it is in memory (since Ghidra tries to set the struct size way too small so I get weird things like accessing fields at this[6]). However, before the call to the constructor is made, no memory is allocated, rather the instruction LEA ECX,[EBP + 0xffff98b4] is executed (where ECX will be the 'this' pointer in the constructor). I don't expect that the explanation of what adding a huge value to EBP actually does would help me in finding out how large the object is, however it has intrigued me enough to wanting to know what it actually does, I hope someone can help

2
  • 1
    Hi and welcome to RE.SE. Isn't it more likely a negative offset? Still big, but still reasonably big for a class.
    – 0xC0000022L
    Jan 15 at 11:31
  • Thank you for the welcome! As it turns out I'm quite blind, however reasonably big depends on the context since this call is made after a lot of setup. This turns out to be the fifth value that got pushed onto the stack
    – MansenC
    Jan 16 at 22:49
2

that is a negative number

C:\>python -c "print(hex(0xffff98b4-2**32))"
-0x674c

or in other words

C:\>python -c "print(hex(2**32 - 0x674c))"
0xffff98b4
1
  • As it turns out yes, I am completely blind
    – MansenC
    Jan 16 at 22:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.