Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [msvc]

Microsoft Visual C/C++ Compiler

-1
votes
1answer
59 views

Why would MSVC pass a constant “2” for an unused this parameter?

Hex-Rays decompiled (with the assistance of pdb symbols) a piece of code as such: XPerfAddIn::CFramesInfoSource::MatchEventDescriptor( (XPerfAddIn::CFramesInfoSource *)2 And by my following of the ...
6
votes
2answers
298 views

Split variable in Hexrays decompiler?

With Microsoft Visual C++ executables, I often run into decompilations like this: void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength) { Pbdf *pbdf; // esi pbdf = pbdfOrLength; ...
0
votes
2answers
159 views

Help reversing code which uses ATL::CStringT

I'm attempting to learn reversing techniques using IDA on an exe built with VC/MFC, and could use a little initial help learning some patterns for simplifying the decompiled code. IDA found ...
1
vote
1answer
207 views

Why would a vtable reference the same function multiple times?

I decompile a VC++ application in IDA 7, and I often find vftables referencing the same function multiple times, like the one I called "Object__pure" here, part of a "heavy-base" Object class ...
1
vote
1answer
90 views

How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? [duplicate]

A C++ program I'm looking at appears to have been compiled with MSVC. It links to MSVCR100.dll, contains MSVC's security cookie code and uses the Microsoft mangling scheme. However, one of the ...
2
votes
0answers
361 views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
1
vote
1answer
65 views

What is the general term used for these pictured symbols?

I see these in VC++ compiled programs often. However, I've searched for several of them, such as AVCCHKBOX@@ and AVCDLC_NAME@@ to no avail. What are these called?
2
votes
1answer
298 views

Why is otkloadr.WRAssembly.1 reference present in a office file?

I was working with a RTF file and I found the string "otkloadr.WRAssembly.1" present inside the file in plain sight. I know that many exploits use this for loading the msvcr71.dll (non-ASLR module). ...
1
vote
1answer
88 views

Why does MSVC x64 Compiler load addresses like this?

Normally, in x86, to load a pointer to a null-terminated string you would use MOV EDX, OFFSET ds:mystring In x64, however, I noticed that the compiler does it like this lea rdx, OFFSET FLAT:$...
3
votes
1answer
400 views

vTable size calculation (for MSVC)

I made some PE analysis script. One part is virtual functions extraction, I implemented vTables lookup using this schema. Actual algorithm of lookup is not important part of question. I don't know ...