| View previous topic :: View next topic |
| Author |
Message |
Loset
Cheater
![]() Reputation: 0
Joined: 18 Apr 2015
Posts: 34
|
 Posted: Fri Jun 26, 2015 3:28 pm Post subject: call a function that is based on pointer? |
 |
|
| Code: | 004E886C |> 8B03 MOV EAX,DWORD PTR DS:[EBX] ; Start YYYY
004E886E |. 6A 01 PUSH 0x1
004E8870 |. 8BCB MOV ECX,EBX
004E8872 |. FF90 0C010000 CALL DWORD PTR DS:[EAX+0x10C] //IMPORTANT CALL !!!!
004E8878 |. 8BD6 MOV EDX,ESI
004E887A |. 8BCE MOV ECX,ESI
004E887C |. E8 2FC8FFFF CALL XXX.004E50B0
004E8881 |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-0x4]
004E8884 |. 6A 14 PUSH 0x14 ; /Arg1 = 00000014
004E8886 |. 8941 04 MOV DWORD PTR DS:[ECX+0x4],EAX ; |
004E8889 |. E8 42A4F1FF CALL XXX.00402CD0 ; \XXX.00402CD0
004E888E |. 8BF8 MOV EDI,EAX
004E8890 |. 83C4 04 ADD ESP,0x4
004E8893 |. 85FF TEST EDI,EDI
004E8895 |. 74 1F JE SHORT XXX.004E88B6
|
so I want to call the "IMPORTANT CALL" from somewhere else seems it only gets 1 or 0 as arguments which is exactly what I wanted.
but unlike previous assembly I dealt with this one is based on pointers
so from where do I start? and how do I know I found something static I can work with?
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 470
Joined: 09 May 2003
Posts: 25785
Location: The netherlands
|
| Posted: Fri Jun 26, 2015 3:42 pm Post subject: |
|
|
it takes two parameters. The current class(ecx) and the first 1/0 parameter (pushed on the stack)
EAX is the vtable pointer located in the first field of the class object. (the vtable pointer is a pointer to a list of functions that belong to the class)
in this case it will call the function at position 10c of the class (the 68's function in the list)
So, to call this you need the address of the object you're interested in before you can call it
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
Loset
Cheater
![]() Reputation: 0
Joined: 18 Apr 2015
Posts: 34
|
| Posted: Fri Jun 26, 2015 4:12 pm Post subject: |
|
|
| Dark Byte wrote: | it takes two parameters. The current class(ecx) and the first 1/0 parameter (pushed on the stack)
EAX is the vtable pointer located in the first field of the class object. (the vtable pointer is a pointer to a list of functions that belong to the class)
in this case it will call the function at position 10c of the class (the 68's function in the list)
So, to call this you need the address of the object you're interested in before you can call it |
wow you got all that from that piece of code?
I dont know yet how to find classes I mean I try with IDA and olly
I have like 3 days experience with reverse engineering and I just managed to do a loop on fire function and I thought that was "WOW!"
so where should I start if I want to do it? I mean are there any tutorials/information that you know of that I can start from to learn how to work with classes and find what I need?
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
