Topic created on: September 7, 2006 09:30 CDT by Piotr .

Hi all,

Consider the following disassembly:

.text:01002108 off_1002108     dd offset loc_1001EA8   ; DATA XREF: wnd_Proc+3A8r
.text:01002108                 dd offset loc_1001F05   ; jump table for switch statement
.text:01002108                 dd offset loc_1001F0D

And the following plugin code:

/* lets say im trying to reach next dword value */
flags =  getFlags(0x1002108+4);

msg("\nFLAGS ARE: %.08x\n",flags);
msg("AFTER D_TYPE: %.08x\n",(flags & DT_TYPE));


if (isUnknown(flags))
msg("IS UNKNOWN\n");
if (hasRef(flags))
msg("HAS REF\n");
if (hasValue(flags))
msg("HAS VALUE\n");
if (isHead(flags))
msg("IS HEAD\n");
if (isOff0(flags))
msg("IS OFF\n");

And here's my output:

- FLAGS ARE: 00400305
- AFTER D_TYPE: 00000000
- HAS VALUE

Well, shortly its not that what i need. I though it should mark that the following value as: is offset (OFF), HEAD, and infact hasRef would be also nice.

Is there any way, to check if the dword value is an offset to a subroutine? And i dont mean here any "tricks" like getbytes and then using IsCode bla bla. I want to stay the code very clear and documented, that should help to protect from getting false positives.

thanks!