title: Is there any way to restore struct by reverse engineering. Pointer to that struct is returned by the only function for export inside DLL
body: <p>Kinda... i have an DLL, that exports the only single function CreateInterface<br />
  From disassembled and then decompiled code:</p>
  
  <pre><code>int __cdecl CreateInterface(const char *a1, int a2)
  {
  //many crazy things
  }
  </code></pre>
  
  <p>here it have a return type as int, but actually it's a pointer to some structure.
  from a main exe this lib is loaded and then used that way:</p>
  
  <pre><code>int (__stdcall *__cdecl Sys_GetFactory(int (__stdcall *hModule)()))()
  {
    int (__stdcall *result)(); // eax@1
  
    result = hModule;
    if ( hModule )
      result = GetProcAddress(hModule, "CreateInterface");
    return result;
  }
  
  void some_funct()
  {
      FARPROC net_interface =  Sys_GetFactory(pModule);
      int s_pClientNet = ((int (__cdecl *)(_DWORD, _DWORD))net_interface)("INetClient_003", 0);
  }
  </code></pre>
  
  <p>and after being initialized it used that way:</p>
  
  <pre><code> int result = (*(int (__stdcall **)(int, int, int, int))(*(_DWORD *)s_pClientNet + 60))(
                   login,
                   password,
                   mw_account_struct,
                   mw_account_struct_size);
  </code></pre>
  
  <p>so.. back to struct. Anyway to restore it, istead of calling needed functions by so crazy way? i mean (s_pClientNet + 60)
  <br/><br />
  P.S. for sure i don't have dll sources, def file and etc. and don't have even idea what functions can be in target class / struct...
  the only thing i know it's some calls to that functions like that s_pClientNet + 60</p>