adplus-dvertising
frame-decoration

Question

How are virtual function calls identified while reversing?

a.

By the use of the ECX register and the fact that the CALL is not using a hard-coded address.

b.

By the fact that the function's pointer and the data it works with reside in the same data structure.

c.

By the fact that the function's address is obtained through a function table.

d.

None of the above

Posted under Reverse Engineering

Answer: (a).By the use of the ECX register and the fact that the CALL is not using a hard-coded address. Explanation:Virtual function calls are identified while reversing by the use of the ECX register and the fact that the CALL is not using a hard-coded address but is instead accessing a data structure in order to get the function's address. This data structure is essentially the same data structure loaded into ECX, which tells us that the function pointer resides inside the object instance and indicates that this is a virtual function call.

Engage with the Community - Add Your Comment

Confused About the Answer? Ask for Details Here.

Know the Explanation? Add it Here.

Q. How are virtual function calls identified while reversing?