views:

47

answers:

1
>    vcam.ax!CopyMediaType()  + 0x49 bytes    
     vcam.ax!CMediaType::Set()  + 0x41 bytes    
     vcam.ax!CMediaType::operator=()  + 0x2f bytes    
     vcam.ax!CVCamStream::SetFormat(_AMMediaType * pmt=0x00000000)  Line 201    C++
     FlashPlayer.exe!005641be()   

Can someone explain the above line by line?

+3  A: 

It means the instruction pointer is in the executable vcam.ax, in the function CopyMediaType(), and the next operation is 0x48 (=73) bytes of machine code into the function.

This function was called from the executable vcam.ax, the method Set of a CMediaType object, and the return address is 0x41 bytes of code into the function.

And so on.

FlashPlayer.exe does not have debug symbols, so it can not tell you in which function the call originated, all it can say is where the return address is. This is the absolute return address in the code from FlashPlazer.exe

SetFormat was called with one parameter, a pointer to an _AMMediaType object. The pointer was NULL.

It seems weird that the other functions don't have parameters. operator= should have one parameter, but the debugger seems to have not enough information to display it. It might be a different function call method, as it recognizes the SetFormat call as C++ code but the others not.

Fozi
Can you especially explain what `_AMMediaType * pmt=0x00000000` and `FlashPlayer.exe!005641be() ` mean?
ollydbg