In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like this
v7 = dword_10038534 v10 = v7 v4 = (*(int (__thiscall **)(int, int))(*(_DWORD *)v10 + 44))(v10, a2);
Am I right to assume this is a pointer?
I would also assume that address is valid within the address space of the DLL module and will change when the DLL is loaded? So how do I calculate the actual run-time address if I load the DLL into my (c++) application?
As you might've noticed, the code I've shown looks like a function call and the function resides at given address. Is there any way to find the actual function body? I am not sure about this, but the functions might be dynamically loaded from another DLL (not through import but rather loadModule & getProcAddress). I managed to find some places where this object (situated at dword_10038534) is constructed, like there are values put at addresses relative to it, however I cannot figure out how the functions are loaded.
For context this DLL was created in late 90s using Visual c++ (most likely VC++4). There is no anti-debug or packing in place. I have heard that patterns like the one I've shown may be connected with C++ classes and virtual method table, however I have strong reasons to believe the DLL was written in C not C++, although this is unconfirmed