Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I am familiar with step 3, but I don't even know where to begin with step 4. I guess it'll remain a mystery... 4ever.


The reasoning is reasonably well explained in the article, I think?

Noting there is an identical pointer in each object, assume this is a pointer to some kind of type definition struct. What will this have in it? There'll likely be a type name, some function pointers for standard operations, maybe a link to any more definitions, that kind of thing. This kind of arrangement is just something you do in C and C++. It's very common.

So take a look at what's at that address, under the assumption it's just a block of pointers. And then look at the first pointer (0x401 is obviously not a pointer). And in this case he got lucky, because it points to a suggestive string. (It could just as easily have pointed to another type definition, or something random. Though it's not uncommon for descriptors to have the name in the first field or two.)

Object type names are usually string literals so it's likely to point into the data segment of an EXE or DLL. (Maybe on Linux you can guess that from the address as well.) That's what the maps thing is all about - figuring out where the string might come from as a way of narrowing down the search.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: