When using IDA, I can press x on any subroutine to see where it is called from. Eventually I end up in the .data section.

But, what am I looking at when I get to this point ?

Are these exports offered by the .dll that I'm looking at ? And, if I get to this point, is it safe to assume that there are no other calls to my function (with the exception of dynamically-generated and/or external calls) ? See reference image below for context.


1 Answer 1


It's hard to tell without more context, but you're probably looking at a virtual function table (vtable). See Converting a virtual table from .rdata into an IDA struct for an example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.