4
votes
Accepted
Split variable in Hexrays decompiler?
I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations.
However, in situations where it's really annoying, creating a ...
- 436
4
votes
What does state mean in unwinding?
the __ehstate_t type is defined as int. toState is the index of the next handler in the array that needs to be unwind.
Action is the operation that needs to be done in order to reach the next state (...
- 912
3
votes
Understanding a C code including CRT functions, decompiled with Ghidra
i looked up at the follow up question in SO and i am posting a reply that lets you compile what you asked
I am not sure what purpose this can solve the header you are including vcxxx is a c only ...
- 16.3k
3
votes
Understanding a C code including CRT functions, decompiled with Ghidra
The documentation can be read in some of the header files which are bundled with Visual Studio. In my case I have the 2019 Community the files are here
C:\Program Files (x86)\Microsoft Visual Studio\...
- 2,629
3
votes
What code produces FuncInfoV1 with zero TryBlocks and zero UnwindMap?
So, EHFlags bits are defined as follows (see ehdata_values.h):
#define FI_EHS_FLAG 0x00000001
#define FI_DYNSTKALIGN_FLAG 0x00000002
#define FI_EHNOEXCEPT_FLAG 0x00000004
i.e. 5 ...
- 36.4k
3
votes
Accepted
MSVC Destructors with 2 Arguments
These wrappers are used in classes with virtual destructors to cover two situations:
ensure that the correct operator delete is called after the object's destruction via delete pClass; statement
...
- 36.4k
3
votes
Accepted
What is the general term used for these pictured symbols?
These strings are part of the Run-Time Type Information (RTTI) produced by Visual C++ for polymorphic classes. This old article of mine describes some of it: http://www.openrce.org/articles/full_view/...
- 36.4k
3
votes
Accepted
Why is otkloadr.WRAssembly.1 reference present in a office file?
Since RTF is a mostly textual file format, noticing plaintext strings in it is not unheard of, and shouldn't be treated as cause for suspicion.
otkloadr.dll is a library used for Visual Studio / ...
- 11.7k
2
votes
Accepted
Why would a vtable reference the same function multiple times?
As I guessed and was confirmed in the comments, this is apparently some compiler optimization reusing methods executing the same logic.
This got clear to me when I reversed the methods of one of the ...
- 1,083
2
votes
Accepted
How can an IA-32 program seemingly compiled with MSVC send its sole argument via EAX?
We can see from this list that IA-32's Delphi/Free Pascal calling convention is the register calling convention. My guess is you're dealing with a binary that's the result of something like this: How ...
- 2,234
2
votes
Accepted
undname.exe: invalid undecorated names
As @blabb says undname is correct so it's your other tool that is 'incorrect'.
However, it's worth looking at this in more detail as it's probably not as incorrect as you think.
To understand this ...
- 2,503
2
votes
What is the mdisp field in RTTI for throw used for?
It seems that inheritance does it. If we do something like:
#include <stdio.h>
struct B {
int a, b;
};
struct B1 {
B1() = default;
B1(const B1& tmp) {
a1 = tmp.a1;
...
- 465
2
votes
Accepted
How can I demangle the name in an RTTI Type Descriptor?
Via Igor Skochinsky's classic IDA RTTI scripts, I found out that the names I posted are equivalent to typeid(struct xyz) (as I've added to my question).
Abusing creating a valid mangled dtor name from ...
- 1,083
2
votes
How can I demangle the name in an RTTI Type Descriptor?
vc++filt seems to demangle it
?AVexception@@
?? AVexception
?AUescaped_list_error@boost@@
?? boost::AUescaped_list_error
?AVruntime_error@stlp_std@@
?? stlp_std::AVruntime_error
?...
- 16.3k
2
votes
x86 weird register call
One reason the compiler will do that is if the function is called two or more times in a given block of code. Loading the pointer into a register saves a few bytes of code space and saves a memory ...
- 9,178
2
votes
vTable size calculation (for MSVC)
You could try the following heuristic: extend the vtable from its given base address until you reach an address that has already been classified as something else (e.g. the COL pointer of the next ...
- 2,010
2
votes
STL Data Structures Hex-Rays
as i commented i used windbg to dump those structures
sample code used for walk through
#include <iostream> //01
#include <list> ...
- 16.3k
1
vote
Accepted
Can a MSVC class have a deletion destructor without a vftable?
Apparently I was confused over the articles wording due to initially seeing deletion destructors as virtual destructors. I analyzed a small scratchpad program and realized the following:
Deletion ...
- 1,083
1
vote
Accepted
One class with different sizes
It looks like CRefCountable is either a base class or the first member of the bigger class/structure being initialized. By itself, it is indeed only 8 bytes (vtable pointer and a data member, most ...
- 36.4k
1
vote
Accepted
What's the meaning of @ tag on proxy dll?
This is called name decoration. Specifically in this case, it denotes __stdcall functions which accept the indicated number of bytes as stack arguments.
The number at the end of the export definition (...
- 36.4k
1
vote
STL Data Structures Hex-Rays
you created those structures or you pulled it from somewhere ?
basically these are template classes and not structures
where did you get the size of 0x1c for std::string
it is 0x18
0x10 for buffer ...
- 16.3k
1
vote
Accepted
Why would MSVC pass a constant "2" for an unused this parameter?
Apparently ecx is just used as a temporary for calculating the value 2 which is copied to r9d and is probably used later in the function.
When the decompiler does not have reliable information ...
- 36.4k
1
vote
undname.exe: invalid undecorated names
there are lot of external utilities that can demangle a decorated name
try looking for vc++filt /
or some online demangler like this
or you can probably code one using dbghelp api ...
- 16.3k
1
vote
Accepted
Class definition
Depending on the original source, the class definition could be entirely in the header file. Class definitions are no longer useful in object files as the compiler already knows how fields and methods ...
- 297
1
vote
Help reversing code which uses ATL::CStringT
Yep, I know it would be "necroanswer" but still may be someone find this answer usefull.
If we have suggestion that decompiler skipped an argument (especially this) you can go into function ...
- 111
1
vote
Help reversing code which uses ATL::CStringT
What is "*(_DWORD *)(a1 - 12) - v3 - 1" doing?
this is probably undocumented or poorly documented i don't know
these are from memory of my fiddling with this Cstring (be aware for misinterpretation ...
- 16.3k
1
vote
Help reversing code which uses ATL::CStringT
to know that, it's better to look at assembler, not pseudocode. If there's an argument passed to sub_428258 through ECX, most likely yes, this should be a method of some class.
maybe error code, which ...
- 1,840
1
vote
Why does MSVC x64 Compiler load addresses like this?
If you disassemble the instructions for
mov edx, offset ds:mystring
vs
lea rdx, offset ds:mystring
You'll notice the LEA instruction length (in bytes) was smaller. Its a compiler optimization!
...
- 368
Only top scored, non community-wiki answers of a minimum length are eligible