VBDec BugAuthor: David Zimmer Date: 12.01.22 - 5:23pm So here is a little oddity I noticed the other day and results in a bug in vbdec for native executables. (PCode is fine). The ProcNames array, MethodLinks, and PrivObj.FuncTypInf arrays are parallel arrays. Well at least they are for PCode. native compile: -------------------------------- source: Public Function a() Private Function b() Private Function d() Public Function c() aProcNamesArray 40191C .text:0040191C dd offset aA .text:00401920 dd 0 .text:00401924 dd 0 .text:00401928 dd offset aC PrivObj.FuncTypInf dd offset Class1_PubFuncTypDesc_a_Func dd 0 dd 0 dd offset Class1_PubFuncTypDesc_c_Func 'file layout of jumps by address ascending .text:004014AC jmp sub_401EF0 'index 0 AAAAAAAA .text:004014B9 jmp loc_401FA0 'index 1 BBBBBBBB .text:004014C6 jmp sub_402040 'index 2 DDDDDDDD .text:004014D3 jmp sub_402110 'index 3 CCCCCCCCThe public functions have entries in the ProcNames array and PrivFuncInfo that correspond to their source function index, with private functions being null. For PCode exes, the MethodLinks table would be parallel as well. 004014AC 004014B9 004014C6 004014D3For native exes, they have shuffled the MethodLinks around so public functions come first. obj.objinfo.aMethodLinkTable 401474 .text:00401474 dd 4014ACh -> AAAAAAAA .text:00401478 dd 4014D3h -> CCCCCCCC .text:0040147C dd 4014B9h -> BBBBBBBB .text:00401480 dd 4014C6h -> DDDDDDDDSo..to apply the correct function prototype, which I was so happy about..actually it looks like we are going to have to sort the functions based on the either function address ascending or the actual address in the method link table and not method link array index. Kind of a pain in the ass but it is what it is apparently... This shuffle was probably done for.... I have no good theory. It doesnt really matter what the vtable looks like, but private functions are in the vtable as well, just all at the end. (Yes we can call private functions by vtable offset) Maybe someone had OCD? I mostly have developed this working with PCode because thats where my first interest was. In order to start working more with native and do more spot checks..I am now implementing a basic native disassembler along with it as well..in for a penny in for a pound i guess... Anyway, be aware of the bug in Misapplied names for native compiles. Ima n00b. (fixed 12.2.22) In other news I have another fun blog post coming on decoded soon. Comments: (0) |
About Me More Blogs Main Site
|
||||||||||||||||||||||||||||