I'm currently reverse-engineering an old game from 2003 to extend its functionality. I have now found what I am looking for and since it was written in C++ I'm trying to re-create the used classes. I have found the constructor call for an important class and now need to know how large it is in memory (since Ghidra tries to set the struct size way too small so I get weird things like accessing fields at this[6]). However, before the call to the constructor is made, no memory is allocated, rather the instruction LEA ECX,[EBP + 0xffff98b4] is executed (where ECX will be the 'this' pointer in the constructor). I don't expect that the explanation of what adding a huge value to EBP actually does would help me in finding out how large the object is, however it has intrigued me enough to wanting to know what it actually does, I hope someone can help
-
1Hi and welcome to RE.SE. Isn't it more likely a negative offset? Still big, but still reasonably big for a class.– 0xC0000022L ♦Commented Jan 15, 2022 at 11:31
-
Thank you for the welcome! As it turns out I'm quite blind, however reasonably big depends on the context since this call is made after a lot of setup. This turns out to be the fifth value that got pushed onto the stack– MansenCCommented Jan 16, 2022 at 22:49
Add a comment
|
1 Answer
that is a negative number
C:\>python -c "print(hex(0xffff98b4-2**32))"
-0x674c
or in other words
C:\>python -c "print(hex(2**32 - 0x674c))"
0xffff98b4
