2

I have following function:

void __thiscall ParsePackage_v5(package_t *package, stream_t *stream)
{
  (*(*package->stream + 8))(package->stream, package, 4);
}

.text:0069F5A0 ; void __thiscall ParsePackage_v5(package_t *package, _DWORD stream)
.text:0069F5A0 ParsePackage_5  proc near               ; CODE XREF: ParsePackageHeader+FB↓p
.text:0069F5A0
.text:0069F5A0                 push    ebp
.text:0069F5A1                 mov     ebp, esp
.text:0069F5A3                 sub     esp, 134h
.text:0069F5A9                 push    ebx
.text:0069F5AA                 push    esi
.text:0069F5AB                 push    edi
.text:0069F5AC                 mov     esi, ecx
.text:0069F5AE                 mov     ecx, [esi+4]
.text:0069F5B1                 mov     eax, [ecx]
.text:0069F5B3                 push    4
.text:0069F5B5                 push    esi
.text:0069F5B6                 call    dword ptr [eax+8]

stream_t defines as:

00000000 stream_t        struc ; (sizeof=0x14, align=0x4, mappedto_136)
00000000 unknown         db ?
00000001                 db ? ; undefined
00000002                 db ? ; undefined
00000003                 db ? ; undefined
00000004 hFile           dd ?                    ; offset
00000008 ReadBytes       db ?
00000009                 db ? ; undefined
0000000A                 db ? ; undefined
0000000B                 db ? ; undefined
0000000C field_C         db ?
0000000D                 db ? ; undefined
0000000E                 db ? ; undefined
0000000F                 db ? ; undefined
00000010 field_10        db ?
00000011                 db ? ; undefined
00000012                 db ? ; undefined
00000013                 db ? ; undefined
00000014 stream_t        ends

(*(*package->stream + 8)) supposed to be converted into package->stream->ReadByte but it wont. How can i do this properly and declare function pointer as field type of ReadByte?

Improve this question

1 Answer 1

Reset to default
1

The first problem in your example is that the fields are defined as bytes, not dwords. Press D twice on those fields to turn them into dwords.

The second problem is that the fields don't have proper function pointer types applied to them. Highlight the fields and press Y to set the type. Enter something like void (__thiscall *ReadBytes)(stream_t *this, package_t *package, size_t size) to create a function pointer type.

Improve this answer
5
  • Big thanks! Unfortunatelly, now i have (*(package->stream->unknown + 8))(package->stream, package, 4); instead of package->stream->ReadBytes(package->stream, package, 4); What's the problem?
    – Timur Vafin
    Nov 4, 2022 at 23:30
  • Ultimately you're going to need two structs. On the line ending in -AE, the code loads the stream_t pointer from the package_t object. On the next line, it loads *stream_t into eax, and the call to [eax+8] finally takes place on line -B6. This is a virtual function call. Your definition of stream_t is incorrect; the dword at +0 needs to be a pointer to a VTable struct that contains the function pointers.
    – Rolf Rolles
    Nov 5, 2022 at 0:24
  • But how can I define vtable structure? Same as stream_t but each field is byte size? Then how (*(package->stream->unknown + 8)) knows that there are function and it needs to be invoked?
    – Timur Vafin
    Nov 5, 2022 at 0:36
  • No, it's a separate structure. I can't tell you what the structure looks like because all I have is a few lines of assembly, but you're going to want a struct called something like stream_t_vtbl which contains dword-sized members whose types are function pointers. The first element of stream_t needs to be a pointer to that structure. As for what the rest of stream_t looks like, I have no idea; the code snippet doesn't show any fields other than its VTable pointer at +0.
    – Rolf Rolles
    Nov 5, 2022 at 1:31
  • I figured it out. Big thanks for helping! You saved my nerves :)
    – Timur Vafin
    Nov 5, 2022 at 3:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.