In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like this

v7 = dword_10038534
v10 = v7
v4 = (*(int (__thiscall **)(int, int))(*(_DWORD *)v10 + 44))(v10, a2);
  1. Am I right to assume this is a pointer?

  2. I would also assume that address is valid within the address space of the DLL module and will change when the DLL is loaded? So how do I calculate the actual run-time address if I load the DLL into my (c++) application?

  3. As you might've noticed, the code I've shown looks like a function call and the function resides at given address. Is there any way to find the actual function body? I am not sure about this, but the functions might be dynamically loaded from another DLL (not through import but rather loadModule & getProcAddress). I managed to find some places where this object (situated at dword_10038534) is constructed, like there are values put at addresses relative to it, however I cannot figure out how the functions are loaded.

For context this DLL was created in late 90s using Visual c++ (most likely VC++4). There is no anti-debug or packing in place. I have heard that patterns like the one I've shown may be connected with C++ classes and virtual method table, however I have strong reasons to believe the DLL was written in C not C++, although this is unconfirmed



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.