Reverse Engineering for Beginners

(avery) #1

CHAPTER 51. C++ CHAPTER 51. C++


GCC—x86


It is almost the same story in GCC 4.4.1, with a few exceptions.


Listing 51.6: GCC 4.4.1
public main
main proc near


var_20 = dword ptr -20h
var_1C = dword ptr -1Ch
var_18 = dword ptr -18h
var_10 = dword ptr -10h
var_8 = dword ptr -8


push ebp
mov ebp, esp
and esp, 0FFFFFFF0h
sub esp, 20h
lea eax, [esp+20h+var_8]
mov [esp+20h+var_20], eax
call _ZN1cC1Ev
mov [esp+20h+var_18], 6
mov [esp+20h+var_1C], 5
lea eax, [esp+20h+var_10]
mov [esp+20h+var_20], eax
call _ZN1cC1Eii
lea eax, [esp+20h+var_8]
mov [esp+20h+var_20], eax
call _ZN1c4dumpEv
lea eax, [esp+20h+var_10]
mov [esp+20h+var_20], eax
call _ZN1c4dumpEv
mov eax, 0
leave
retn
main endp


Here we see anothername manglingstyle, specific to GNU^3 It can also be noted that the pointer to the object is passed as
the first function argument—invisible to programmer, of course.


First constructor:


public _ZN1cC1Ev ; weak
_ZN1cC1Ev proc near ; CODE XREF: main+10


arg_0 = dword ptr 8


push ebp
mov ebp, esp
mov eax, [ebp+arg_0]
mov dword ptr [eax], 667
mov eax, [ebp+arg_0]
mov dword ptr [eax+4], 999
pop ebp
retn
_ZN1cC1Ev endp


It just writes two numbers using the pointer passed in the first (and only) argument.


Second constructor:


public _ZN1cC1Eii
_ZN1cC1Eii proc near


arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h


push ebp

(^3) There is a good document about the various name mangling conventions in different compilers: [Fog14].

Free download pdf