C++ Constructor or Destructor? (Reverse Engineering)

174 views Asked by At

I am new to Ghidra and reverse engineering, but i do have C++ experience.

I was analysing this function:

void __fastcall Class_J::FUN_Class_J_0044c960(Class_J *this)

{
  this->vTable = (undefined *)&PTR__purecall_004b0f38;
  if (this->pointer_field9_0x24 != (undefined *)0x0) {
    operator_delete(this->pointer_field9_0x24);
    this->pointer_field9_0x24 = (undefined *)0x0;
  }
  FUN_Class_J_0044c990(this);
  return;
}

Due to the vTable being filled here I expected this to be an constructor of Class_J. But the call of operator_delete makes me think of being an destructor.

Or does this function only make sure, that the pointer is cleared? But what if the garbage in memory at this->pointer_field9_0x24 points to a valid address? Then it would free an random object in memory, wouldn't it?

Am i missing something?

The function FUN_Class_J_0044c990 could also theoretical be either.

void __thiscall Class_J::FUN_Class_J_0044c990(Class_J *this)

{
  this->field10_0x28 = -1;
  this->field1_0x4 = 0;
  this->field2_0x8 = 0;
  this->field3_0xc = 0;
  this->field5_0x14 = 0;
  this->field4_0x10 = 0;
  this->field6_0x18 = 0;
  this->field7_0x1c = 0;
  this->field8_0x20 = 0;
  this->pointer_field9_0x24 = (undefined *)0x0;
  return;
}

and is only called by another function:

void __thiscall Class_J::FUN_Class_J_0044c920(Class_J *this)

{
  this->vTable = (undefined *)&PTR__purecall_004b0f38;
  FUN_Class_J_0044c990(this);
  return;
}

which I would identify as an constructor.

0

There are 0 answers