Search code examples
c++x86reverse-engineeringcalling-convention

is this some kind of casting function? if so, why is it __thiscall?


I am reverse-engineering a program, and found a member method that looks like this:

int __thiscall sub_40A490(void *this)
{
    return *(_DWORD *)this;
}

IDA generated this code, the original assembly looks like this:

sub_      proc near              
          mov     eax, [ecx]
          retn
sub_      endp

What is this? If its a simple cast, why is it a __thiscall?

There are lots of cross-references to this functions. For example, we have this one here calling it:

char __cdecl sub_4011B0(int a1, int a2)
{
    char v2; // bl
    int v3; // esi
    _DWORD *v4; // eax
    int v5; // eax
    
    if ( !a1 || !a2 )
        return 0;
    v2 = byte_593B70[4 * *(_DWORD *)(a1 + 504) + *(_DWORD *)(a2 + 504)];
    if ( !v2 )
    {
        v3 = 0;
        if ( sub_40A490((void *)(a1 + 1196)) > 0 )
        {
            while ( 1 )
            {
                v4 = (_DWORD *)sub_40A480(v3);
                v5 = sub_40A0E0(*v4);
                if ( v5 )
                {
                    if ( *(_DWORD *)(v5 + 44) == *(_DWORD *)(a2 + 44) )
                        return 1;
                }
                else
                {
                    sub_4CE390(v3);
                }
                if ( ++v3 >= sub_40A490((void *)(a1 + 1196)) )
                    return 0;
            }
        }
    }
    return v2;
}

Solution

  • Probably is the solution: from comments

    "It looks to me like sub_40A490 is a member function of some class which returns a _DWORD member, which is the first member of the class."

    – François Andrieux