Hot answers tagged

4

the __ehstate_t type is defined as int. toState is the index of the next handler in the array that needs to be unwind. Action is the operation that needs to be done in order to reach the next state (the value of toState). This happens until toState reaches -1, which is the "blank" state that ends the unwinding process. The state is incremented by one every ...


3

These wrappers are used in classes with virtual destructors to cover two situations: ensure that the correct operator delete is called after the object's destruction via delete pClass; statement deletion of arrays allocated via new Class[N] expression in the delete [] class_array; statement to ensure the correct number of items gets deleted using the ...


3

I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations. However, in situations where it's really annoying, creating a union type in the Structure viewer can be helpful. Then, in your decompiler, set the type of the variable to the union type (Y is the keyboard shortcut). In ...


3

These strings are part of the Run-Time Type Information (RTTI) produced by Visual C++ for polymorphic classes. This old article of mine describes some of it: http://www.openrce.org/articles/full_view/23


3

Since RTF is a mostly textual file format, noticing plaintext strings in it is not unheard of, and shouldn't be treated as cause for suspicion. otkloadr.dll is a library used for Visual Studio / office integration, as part of a package called "Microsoft Visual Studio Tools for the Microsoft Office System". That package is used to incorporate Visual Studio ...


2

As I guessed and was confirmed in the comments, this is apparently some compiler optimization reusing methods executing the same logic. This got clear to me when I reversed the methods of one of the more specific objects, like the data stream reader / writer here: seg002:008F4FC4 const DataStream::`vftable' dd offset DataStream__readByte ; DATA XREF: ...


2

We can see from this list that IA-32's Delphi/Free Pascal calling convention is the register calling convention. My guess is you're dealing with a binary that's the result of something like this: How to call a function using Delphi's register calling conventions from Visual C++? To partially quote the top-voted answer: Delphi's register calling ...


2

Via Igor Skochinsky's classic IDA RTTI scripts, I found out that the names I posted are equivalent to typeid(struct xyz) (as I've added to my question). Abusing creating a valid mangled ctor name from a substring of them and then stripping the ctor parts from the result yields great class names. Here's my Python script and the results: def demangle(name): ...


2

vc++filt seems to demangle it ?AVexception@@ ?? AVexception ?AUescaped_list_error@boost@@ ?? boost::AUescaped_list_error ?AVruntime_error@stlp_std@@ ?? stlp_std::AVruntime_error ?AUescaped_list_error@boost@@ ?? boost::AUescaped_list_error src slightly edited to strip . in front cat cpp.cpp #include <windows.h> #include <stdio.h> #include &...


2

As @blabb says undname is correct so it's your other tool that is 'incorrect'. However, it's worth looking at this in more detail as it's probably not as incorrect as you think. To understand this though you have to delve a little into ABIs and think how a C++ function call works in practice. Firstly, a C++ member function is in some sense like a C ...


2

So, EHFlags bits are defined as follows (see ehdata_values.h): #define FI_EHS_FLAG 0x00000001 #define FI_DYNSTKALIGN_FLAG 0x00000002 #define FI_EHNOEXCEPT_FLAG 0x00000004 i.e. 5 is FI_EHS_FLAG|FI_EHNOEXCEPT_FLAG In crt\src\vcruntime\frame.cpp we can find this snippet: auto tryBlockMap = T::TryBlockMap(pFuncInfo, pDC); if (...


2

You could try the following heuristic: extend the vtable from its given base address until you reach an address that has already been classified as something else (e.g. the COL pointer of the next vtable) or you find something that is not the address of a known function in a known code segment. This analysis step should be deferred until after the full web ...


2

as i commented i used windbg to dump those structures sample code used for walk through #include <iostream> //01 #include <list> //02 #include <vector> //03 #include <map> ...


1

you created those structures or you pulled it from somewhere ? basically these are template classes and not structures where did you get the size of 0x1c for std::string it is 0x18 0x10 for buffer or Pointer (static small string or malloced() bigstring ) 0x4 for Actualsize or_Mysize 0x4 for Reservedsize or _Myres like typedef struct _FOO { union _Bx { char ...


1

It seems that inheritance does it. If we do something like: #include <stdio.h> struct B { int a, b; }; struct B1 { B1() = default; B1(const B1& tmp) { a1 = tmp.a1; printf("B1::B1 copy constr\n"); } int a1, b1; }; struct A : B, B1 { int b, c; }; int main() try { struct A tmp; tmp.a1 = 9; ...


1

there are lot of external utilities that can demangle a decorated name try looking for vc++filt / or some online demangler like this or you can probably code one using dbghelp api UndecorateSymbolName() in python with ctype / pywin32 also undname isn't erring your second guess must be right I just prototyped a similar function and looked at its ...


1

Depending on the original source, the class definition could be entirely in the header file. Class definitions are no longer useful in object files as the compiler already knows how fields and methods are laid out. You have to guess the original definition. Keep in mind that you already have guessed a lot when reverting via hex-rey as C++ allows ...


1

Apparently ecx is just used as a temporary for calculating the value 2 which is copied to r9d and is probably used later in the function. When the decompiler does not have reliable information about function prototype, it has to resort to heuristics, or guessing. Since the demangled function name looks like a C++ method, it assumes that it’s a method of ...


1

What is "*(_DWORD *)(a1 - 12) - v3 - 1" doing? this is probably undocumented or poorly documented i don't know these are from memory of my fiddling with this Cstring (be aware for misinterpretation from my part too ) it is trying to return you the substring after *\* the Cstring when initialized is normally a part of a bigger structure or class or ...


1

to know that, it's better to look at assembler, not pseudocode. If there's an argument passed to sub_428258 through ECX, most likely yes, this should be a method of some class. maybe error code, which should be returned by the function. I.e. current function definition might be wrong. Can't tell without seeing the assembler. seems like it's accessing to some ...


1

If you disassemble the instructions for mov edx, offset ds:mystring vs lea rdx, offset ds:mystring You'll notice the LEA instruction length (in bytes) was smaller. Its a compiler optimization! Or, it could be the compilers way of addressing pointer arithmetic in an easier manner. Check out this for more info on both.


Only top voted, non community-wiki answers of a minimum length are eligible