3

When using IDA, I can press x on any subroutine to see where it is called from. Eventually I end up in the .data section.

But, what am I looking at when I get to this point ?

Are these exports offered by the .dll that I'm looking at ? And, if I get to this point, is it safe to assume that there are no other calls to my function (with the exception of dynamically-generated and/or external calls) ? See reference image below for context.

XRefs

perror
  • 19,083
  • 29
  • 87
  • 150
zz3star90
  • 107
  • 1
  • 8

1 Answers1

3

It's hard to tell without more context, but you're probably looking at a virtual function table (vtable). See Converting a virtual table from .rdata into an IDA struct for an example.

Community
  • 1
Jason Geffner
  • 20,681
  • 1
  • 36
  • 75