Hot answers tagged

4 votes

What does state mean in unwinding?

the __ehstate_t type is defined as int. toState is the index of the next handler in the array that needs to be unwind. Action is the operation that needs to be done in order to reach the next state (...
user avatar
  • 822
3 votes

Understanding a C code including CRT functions, decompiled with Ghidra

i looked up at the follow up question in SO and i am posting a reply that lets you compile what you asked I am not sure what purpose this can solve the header you are including vcxxx is a c only ...
user avatar
  • 14.8k
3 votes

Understanding a C code including CRT functions, decompiled with Ghidra

The documentation can be read in some of the header files which are bundled with Visual Studio. In my case I have the 2019 Community the files are here C:\Program Files (x86)\Microsoft Visual Studio\...
user avatar
  • 2,315
3 votes
Accepted

MSVC Destructors with 2 Arguments

These wrappers are used in classes with virtual destructors to cover two situations: ensure that the correct operator delete is called after the object's destruction via delete pClass; statement ...
user avatar
  • 34.6k
3 votes
Accepted

Split variable in Hexrays decompiler?

I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations. However, in situations where it's really annoying, creating a ...
user avatar
3 votes
Accepted

What is the general term used for these pictured symbols?

These strings are part of the Run-Time Type Information (RTTI) produced by Visual C++ for polymorphic classes. This old article of mine describes some of it: http://www.openrce.org/articles/full_view/...
user avatar
  • 34.6k
3 votes
Accepted

Why is otkloadr.WRAssembly.1 reference present in a office file?

Since RTF is a mostly textual file format, noticing plaintext strings in it is not unheard of, and shouldn't be treated as cause for suspicion. otkloadr.dll is a library used for Visual Studio / ...
user avatar
  • 11.3k
2 votes
Accepted

Why would a vtable reference the same function multiple times?

As I guessed and was confirmed in the comments, this is apparently some compiler optimization reusing methods executing the same logic. This got clear to me when I reversed the methods of one of the ...
user avatar
  • 983
2 votes
Accepted

How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX?

We can see from this list that IA-32's Delphi/Free Pascal calling convention is the register calling convention. My guess is you're dealing with a binary that's the result of something like this: How ...
user avatar
  • 2,144
2 votes
Accepted

How can I demangle the name in an RTTI Type Descriptor?

Via Igor Skochinsky's classic IDA RTTI scripts, I found out that the names I posted are equivalent to typeid(struct xyz) (as I've added to my question). Abusing creating a valid mangled dtor name from ...
user avatar
  • 983
2 votes

How can I demangle the name in an RTTI Type Descriptor?

vc++filt seems to demangle it ?AVexception@@ ?? AVexception ?AUescaped_list_error@boost@@ ?? boost::AUescaped_list_error ?AVruntime_error@stlp_std@@ ?? stlp_std::AVruntime_error ?...
user avatar
  • 14.8k
2 votes

What code produces FuncInfoV1 with zero TryBlocks and zero UnwindMap?

So, EHFlags bits are defined as follows (see ehdata_values.h): #define FI_EHS_FLAG 0x00000001 #define FI_DYNSTKALIGN_FLAG 0x00000002 #define FI_EHNOEXCEPT_FLAG 0x00000004 i.e. 5 ...
user avatar
  • 34.6k
2 votes

vTable size calculation (for MSVC)

You could try the following heuristic: extend the vtable from its given base address until you reach an address that has already been classified as something else (e.g. the COL pointer of the next ...
user avatar
  • 1,940
2 votes

What is the mdisp field in RTTI for throw used for?

It seems that inheritance does it. If we do something like: #include <stdio.h> struct B { int a, b; }; struct B1 { B1() = default; B1(const B1& tmp) { a1 = tmp.a1; ...
user avatar
  • 383
2 votes
Accepted

undname.exe: invalid undecorated names

As @blabb says undname is correct so it's your other tool that is 'incorrect'. However, it's worth looking at this in more detail as it's probably not as incorrect as you think. To understand this ...
user avatar
  • 2,134
2 votes

STL Data Structures Hex-Rays

as i commented i used windbg to dump those structures sample code used for walk through #include <iostream> //01 #include <list> ...
user avatar
  • 14.8k
1 vote

STL Data Structures Hex-Rays

you created those structures or you pulled it from somewhere ? basically these are template classes and not structures where did you get the size of 0x1c for std::string it is 0x18 0x10 for buffer ...
user avatar
  • 14.8k
1 vote
Accepted

Can a MSVC class have a deletion destructor without a vftable?

Apparently I was confused over the articles wording due to initially seeing deletion destructors as virtual destructors. I analyzed a small scratchpad program and realized the following: Deletion ...
user avatar
  • 983
1 vote
Accepted

One class with different sizes

It looks like CRefCountable is either a base class or the first member of the bigger class/structure being initialized. By itself, it is indeed only 8 bytes (vtable pointer and a data member, most ...
user avatar
  • 34.6k
1 vote
Accepted

What's the meaning of @ tag on proxy dll?

This is called name decoration. Specifically in this case, it denotes __stdcall functions which accept the indicated number of bytes as stack arguments. The number at the end of the export definition (...
user avatar
  • 34.6k
1 vote

undname.exe: invalid undecorated names

there are lot of external utilities that can demangle a decorated name try looking for vc++filt / or some online demangler like this or you can probably code one using dbghelp api ...
user avatar
  • 14.8k
1 vote
Accepted

Class definition

Depending on the original source, the class definition could be entirely in the header file. Class definitions are no longer useful in object files as the compiler already knows how fields and methods ...
user avatar
  • 242
1 vote
Accepted

Why would MSVC pass a constant "2" for an unused this parameter?

Apparently ecx is just used as a temporary for calculating the value 2 which is copied to r9d and is probably used later in the function. When the decompiler does not have reliable information ...
user avatar
  • 34.6k
1 vote

Help reversing code which uses ATL::CStringT

What is "*(_DWORD *)(a1 - 12) - v3 - 1" doing? this is probably undocumented or poorly documented i don't know these are from memory of my fiddling with this Cstring (be aware for misinterpretation ...
user avatar
  • 14.8k
1 vote

Help reversing code which uses ATL::CStringT

to know that, it's better to look at assembler, not pseudocode. If there's an argument passed to sub_428258 through ECX, most likely yes, this should be a method of some class. maybe error code, which ...
user avatar
  • 1,750
1 vote

Why does MSVC x64 Compiler load addresses like this?

If you disassemble the instructions for mov edx, offset ds:mystring vs lea rdx, offset ds:mystring You'll notice the LEA instruction length (in bytes) was smaller. Its a compiler optimization! ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible