Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   StringT functions interpretion (https://forum.exetools.com/showthread.php?t=16904)

zhgong007 06-26-2015 18:09

StringT functions interpretion
 
anybody can explain the code where I have marked, many thanks! especially I don't understand what typer of operator is using by the string operation MFC function; thanks for your help


Code:

int __cdecl sub_47D97D(int a1, int a2, int a3)
{
  int v3; // eax@1
  int v4; // eax@2
  int v5; // eax@5
  int v6; // eax@5
  int v7; // eax@6

  ((void (__thiscall *)(int, _DWORD))ATL::CStringT<char_StrTraitMFC_DLL<char_ATL::ChTraitsCRT<char>>>::CStringT<char_StrTraitMFC_DLL<char_ATL::ChTraitsCRT<char>>>)(
    a1,
    0);                  //what does it mean?
  v3 = 0;
  while ( a3 > 0 )
  {
    --a3;
    v4 = ATL::CStringT<char_StrTraitMFC_DLL<char_ATL::ChTraitsCRT<char>>>::Find(45, v3);
    if ( v4 == -1 )
      return a1;
    v3 = v4 + 1;
  }
  v5 = ATL::CStringT<char_StrTraitMFC_DLL<char_ATL::ChTraitsCRT<char>>>::Mid(a2, &a3, v3);
  ATL::CStringT<char_StrTraitMFC_DLL<char_ATL::ChTraitsCRT<char>>>::operator_(a1, v5);  //what mean?
  ATL::CStringT<char_StrTraitMFC_DLL<char_ATL::ChTraitsCRT<char>>>::_CStringT<char_StrTraitMFC_DLL<char_ATL::ChTraitsCRT<char>>>(&a3);  //what mean?
  v6 = ATL::CStringT<char_StrTraitMFC_DLL<char_ATL::ChTraitsCRT<char>>>::Find(45, 0);
  if ( v6 >= 0 )
  {
    v7 = ATL::CStringT<char_StrTraitMFC_DLL<char_ATL::ChTraitsCRT<char>>>::Left(a1, &a3, v6);
    ATL::CStringT<char_StrTraitMFC_DLL<char_ATL::ChTraitsCRT<char>>>::operator_(a1, v7);  //what mean?
    ATL::CStringT<char_StrTraitMFC_DLL<char_ATL::ChTraitsCRT<char>>>::_CStringT<char_StrTraitMFC_DLL<char_ATL::ChTraitsCRT<char>>>(&a3);    ////what mean?
  }
  return a1;
}


Syoma 06-26-2015 20:56

https://msdn.microsoft.com/en-us/library/aa314317(v=vs.60).aspx
CString( TCHAR ch, int nRepeat = 1 );
throw( CMemoryException );
?

zhgong007 06-26-2015 21:23

thanksfor your answer, Syoma. but I don't understand. the code I attached is the pseudo code translated by IDA. if you translate them back to standart C++, what will be the corresponding codes for the pseudo code?

Syoma 06-27-2015 04:55

Follow MSDN and restore the functions names. Then restore code logic.
HexRays is not the best tool to restore OO code. Refer both decompilation and disasm to understand the logic.


All times are GMT +8. The time now is 19:53.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX