Log in

View Full Version : Where are the Class methods?


5aLIVE
July 27th, 2005, 13:55
I've posted this over at EXE Tools too in the hope of increasing the reader count.

I'm using DeDe to help analyse an app and I've found a handful of class names of interest displayed in the Classes Info screen

Such as TBasicCryptographyStream, TEncryptionStream and TDecryptionStream to name a few.

What puzzles me is that these particular classes do not show a unit name asscociated with a given Class name.

Double clicking one of the above class names doesn't show any methods and their respective RVAs to investigate either.

Clicking on the Units Info tab reveals no entries.

If I open this EXE in good old PE Explorer and view the PACKAGEINFO in the resource section it shows a few unit names that I'd like to examine. DeDe doesn't appear to show these units

Any ideas/suggestion to help find what I'm looking for?
Finding these methods should improve my chances of isolating the code I need to find, analyse, and rip.


Thanks for any help.

5aLIVE
July 28th, 2005, 04:25
The Class Info window shows a Self Pointer for every ClassName, if you go to a particular self pointer RVA in IDA it shows the name of the class but not much else.

What does this mean? The class is imported but no methods are explicitly used?

I forgot to mention in my first post that clicking on the Procedures tab shows a list of Unit and Class names but not all the ones listed in the PACKAGEINFO and not the ones I'd like to take a peek at.

Anyone?