1

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like this

v7 = dword_10038534
v10 = v7
v4 = (*(int (__thiscall **)(int, int))(*(_DWORD *)v10 + 44))(v10, a2);
  1. Am I right to assume this is a pointer?

  2. I would also assume that address is valid within the address space of the DLL module and will change when the DLL is loaded? So how do I calculate the actual run-time address if I load the DLL into my (c++) application?

  3. As you might've noticed, the code I've shown looks like a function call and the function resides at given address. Is there any way to find the actual function body? I am not sure about this, but the functions might be dynamically loaded from another DLL (not through import but rather loadModule & getProcAddress). I managed to find some places where this object (situated at dword_10038534) is constructed, like there are values put at addresses relative to it, however I cannot figure out how the functions are loaded.

For context this DLL was created in late 90s using Visual c++ (most likely VC++4). There is no anti-debug or packing in place. I have heard that patterns like the one I've shown may be connected with C++ classes and virtual method table, however I have strong reasons to believe the DLL was written in C not C++, although this is unconfirmed

1

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.