[your-name-here]

First question: Is it a pointer to a pointer? Or is it just a plain pointer?

Second question: If I had this signature:

\x8B\x0D\xC8\xA7\x61\x10\x81\x2A\x2A\x2A\x2A\ x2A\xE8\x2A\x2A\x2A\x2A\x84\xC0\x74\x2C"

And in IDA it says:

8B 0D C8 A7 61 10 mov ecx, TheDirector

Would the address of TheDirector be the address of the signature + 2?

Just asking to make sure because I seem to be crashing when using TheDirector. Most likely because it's either a pointer to a pointer (which I need to dereference) or I'm not grabbing it's address right :/

Thanks in advance,
your-name-here

[Fyren]

Well, the first thing I noticed is your signature has the address inside of it and not masked.

But to figure out what it is, you should look at the assembly to see how it's used.

[your-name-here]

No it is masked :p

I just removed it for the purpose of this post. In my actual signature, the
"\xC8\xA7\x61\x10" IS "\x2A\x2A\x2A\x2A". This is the address of TheDirector. However, I still can't manage to make calls using this pointer