Solved IDA - Xref points to .rdata - What does it mean?

Hexui Undetected CSGO Cheats Sinkicheat PUBG Cheat


Full Member
Sep 26, 2015

I finally managed to find the pointer and offsets of the coordinates and player list of Assault Cube manually using Cheat Engine and IDA.
The next game is a pretty old MMO where I want to find the player coordinates.

Same as before I found the dynamic address of the coordinates of one player using Cheat Engine. Then I traversed through the code to find the offsets using IDA.

Right now I am stuck at one point. I need to know where the register ECX gets filled.

Since this sub doesn't fill ECX I listed the cross references, which only shows one entry pointing to:

I have read that .rdata holds read-only pre-initialized data.
I also read that a xref pointing to the data section could be a vtable.

Please enlighten me :)


Escobar Tier VIP
Trump Tier Donator
Jun 25, 2014
1. It's a thiscall ( or fastcall )
2. You can tell because ecx is used without being set
3. You can super tell because its in that function array you see, this would most likely be a (virtual) function table, every class that contains virtual functions in it will have a virtual function table.
4. All of those functions are then thiscalls.
5. Ecx contains a pointer to the class object
Attention! Before you post:

Read the How to Ask Questions Guide
99% of questions are answered in the Beginner's Guide, do it before asking a question.

No Hack Requests. Post in the correct section.  Search the forum first. Read the rules.

How to make a good post:

  • Fill out the form correctly
  • Tell us the game name & coding language
  • Post everything we need to know to help you
  • Ask specific questions, be descriptive
  • Post errors, line numbers & screenshots
  • Post code snippets using code tags
  • If it's a large project, zip it up and attach it

If you do not comply, your post may be deleted.  We want to help, please make a good post and we will do our best to help you.

Community Mods