Questions tagged [msvc]

Microsoft Visual C/C++ Compiler

Filter by
Sorted by
Tagged with
0
votes
0answers
24 views

Some more questions related to C++ exceptions (catchHigh)

I've came up with the most convoluted example but still can't find the purpose of the catchHigh field. I find it that the right handler can be selected simply by looking at the tryblock map from start ...
1
vote
1answer
64 views

What code produces FuncInfoV1 with zero TryBlocks and zero UnwindMap?

Topic is C++ exceptions internal representation in WIndows x86 binaries compiled with msvc. I've found a code that straight up doesn't have nothing (all fields of FuncInfo zero) except the EHFlags ...
2
votes
1answer
83 views

What does state mean in unwinding?

I'm looking at UnwindMapEntry. Here is it's declaration: // // UnwindMapEntry - Description of each state transition for unwinding // the stack (i.e. calling destructors). // // The unwind map is an ...
1
vote
1answer
32 views

What is the mdisp field in RTTI for throw used for?

First of here is the article from which I'm looking up the fields. I was trying out different combinations to see how they affect the RTTI for a C++ throw. It seems that having a virtual base class ...
2
votes
1answer
66 views

MSVC Destructors with 2 Arguments

I'm reversing a program which I assume was compiled with MSVC. It's seeming like the first entry in each vtable is the class' destructor. However, when I look at the disassembly and decompilation, it ...
2
votes
2answers
63 views

undname.exe: invalid undecorated names

I've discovered undname.exe today and tried it on several functions. I got some incorrect results and I'm wondering why. I see two main reasons that could do that: The mangling can change between ...
0
votes
1answer
44 views

Class definition

I have a complicated question to ask so I will try my best to be clear. I have this binary I am trying to reverse that came with a pdb file. I have dumped the compilands of the binary to begin with. ...
1
vote
2answers
410 views

How can I demangle the name in an RTTI Type Descriptor?

I'm currently browsing through RTTI information available in an MSVC++2003 executable (writing an IDAPython script to recreate structs for the class hierarchy). Apparently, as visualized here, the ...
-1
votes
1answer
87 views

Why would MSVC pass a constant “2” for an unused this parameter?

Hex-Rays decompiled (with the assistance of pdb symbols) a piece of code as such: XPerfAddIn::CFramesInfoSource::MatchEventDescriptor( (XPerfAddIn::CFramesInfoSource *)2 And by my following of the ...
6
votes
2answers
828 views

Split variable in Hexrays decompiler?

With Microsoft Visual C++ executables, I often run into decompilations like this: void __cdecl Pbdf::ReadString(char *dst, Pbdf *pbdfOrLength) { Pbdf *pbdf; // esi pbdf = pbdfOrLength; ...
0
votes
2answers
607 views

Help reversing code which uses ATL::CStringT

I'm attempting to learn reversing techniques using IDA on an exe built with VC/MFC, and could use a little initial help learning some patterns for simplifying the decompiled code. IDA found ...
2
votes
1answer
323 views

Why would a vtable reference the same function multiple times?

I decompile a VC++ application in IDA 7, and I often find vftables referencing the same function multiple times, like the one I called "Object__pure" here, part of a "heavy-base" Object class ...
1
vote
1answer
108 views

How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX? [duplicate]

A C++ program I'm looking at appears to have been compiled with MSVC. It links to MSVCR100.dll, contains MSVC's security cookie code and uses the Microsoft mangling scheme. However, one of the ...
3
votes
0answers
789 views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
1
vote
1answer
67 views

What is the general term used for these pictured symbols?

I see these in VC++ compiled programs often. However, I've searched for several of them, such as AVCCHKBOX@@ and AVCDLC_NAME@@ to no avail. What are these called?
2
votes
1answer
363 views

Why is otkloadr.WRAssembly.1 reference present in a office file?

I was working with a RTF file and I found the string "otkloadr.WRAssembly.1" present inside the file in plain sight. I know that many exploits use this for loading the msvcr71.dll (non-ASLR module). ...
1
vote
1answer
122 views

Why does MSVC x64 Compiler load addresses like this?

Normally, in x86, to load a pointer to a null-terminated string you would use MOV EDX, OFFSET ds:mystring In x64, however, I noticed that the compiler does it like this lea rdx, OFFSET FLAT:$...
2
votes
1answer
641 views

vTable size calculation (for MSVC)

I made some PE analysis script. One part is virtual functions extraction, I implemented vTables lookup using this schema. Actual algorithm of lookup is not important part of question. I don't know ...