Hot answers tagged

3

IDA knew that there was a struct named ComputeService::RPC due to a mangled name containing a reference to it -- for example, a mangled name for the function shown in your question. However, IDA did not have a struct declaration for it, so it created an empty struct -- you can tell this because the Description field for that entry simply says struct. If IDA ...


2

The function's name isn't struct dynamic_array. The function's name is Mesh::CalculateBoneBindPoseBounds. The function accepts an argument of type struct dynamic_array<...>. There's no function named dynamic_array, as it's simply as structure defined within the binary. The name does imply we're dealing with an std::vector-like object, so I'd start with ...


2

Is there a way to check what are the fields inside this struct? The old fashion way. Follow that pointer around through the assembly and see what offsets are used and how. If you can find where it's created, you can know it's total size. If you can debug the program live you can set watch points and see what data actually gets put into each offset. The size ...


2

that is a negative number C:\>python -c "print(hex(0xffff98b4-2**32))" -0x674c or in other words C:\>python -c "print(hex(2**32 - 0x674c))" 0xffff98b4


1

At a guess, the class participates in a virtual inheritance tree. When constructing a class with virtual bases, the constructor needs to know whether its virtual bases have been already constructed or not. The extra argument is used for that. If you compile a sample program with virtual inheritance and look at its assembly output, you'll see that it's called ...


1

From that screenshot you can see the base of the vtable is referenced - likely when the object is constructed. You'll need to keep an eye on where the object gets stored and follow it through the code


1

It looks like CRefCountable is either a base class or the first member of the bigger class/structure being initialized. By itself, it is indeed only 8 bytes (vtable pointer and a data member, most likely the reference count).


Only top voted, non community-wiki answers of a minimum length are eligible