Reverse Engineering for Beginners

(avery) #1

CHAPTER 51. C++ CHAPTER 51. C++


Listing 51.1: MSVC

_c2$ = -16 ; size = 8
_c1$ = -8 ; size = 8
_main PROC
push ebp
mov ebp, esp
sub esp, 16
lea ecx, DWORD PTR _c1$[ebp]
call ??0c@@QAE@XZ ; c::c
push 6
push 5
lea ecx, DWORD PTR _c2$[ebp]
call ??0c@@QAE@HH@Z ; c::c
lea ecx, DWORD PTR _c1$[ebp]
call ?dump@c@@QAEXXZ ; c::dump
lea ecx, DWORD PTR _c2$[ebp]
call ?dump@c@@QAEXXZ ; c::dump
xor eax, eax
mov esp, ebp
pop ebp
ret 0
_main ENDP


Here’s what’s going on. For each object (instance of classc) 8 bytes are allocated, exactly the size needed to store the 2
variables.


Forc1a default argumentless constructor??0c@@QAE@XZis called. Forc2another constructor??0c@@QAE@HH@Zis called
and two numbers are passed as arguments.


A pointer to the object (thisin C++ terminology) is passed in theECXregister. This is called thiscall (51.1.1)—the method
for passing a pointer to the object.


MSVC does it using theECXregister. Needless to say, it is not a standardized method, other compilers can do it differently,
e.g., via the first function argument (like GCC).


Why do these functions have such odd names? That’sname mangling.


A C++ class may contain several methods sharing the same name but having different arguments—that is polymorphism. And
of course, different classes may have their own methods with the same name.


Name manglingenable us to encode the class name + method name + all method argument types in one ASCII string, which
is then used as an internal function name. That’s all because neither the linker, nor the DLLOSloader (mangled names may
be among the DLL exports as well) knows anything about C++ orOOP^1.


Thedump()function is called two times.


Now let’s see the constructors’ code:


Listing 51.2: MSVC

_this$ = -4 ; size = 4
??0c@@QAE@XZ PROC ; c::c, COMDAT
; _this$ = ecx
push ebp
mov ebp, esp
push ecx
mov DWORD PTR _this$[ebp], ecx
mov eax, DWORD PTR _this$[ebp]
mov DWORD PTR [eax], 667
mov ecx, DWORD PTR _this$[ebp]
mov DWORD PTR [ecx+4], 999
mov eax, DWORD PTR _this$[ebp]
mov esp, ebp
pop ebp
ret 0
??0c@@QAE@XZ ENDP ; c::c


_this$ = -4 ; size = 4
_a$ = 8 ; size = 4
_b$ = 12 ; size = 4
??0c@@QAE@HH@Z PROC ; c::c, COMDAT


(^1) Object-Oriented Programming

Free download pdf