Reversing : The Hacker's Guide to Reverse Engineering

Figure C.6 In-memory layout of objects with virtual function tables. Note that this layout

is more or less generic and is used by all compilers.

class Base

{

int BaseMember1;

virtual VirtualFunc1();

}; virtual VirtualFunc2();

Base Class

class Child1 : Base

{

int Child1Member1;

virtual Child1Func();VirtualFunc1();

VirtualFunc2();

};

Child1 Class

class Child2 : Base

{ int Child2Member1;

VirtualFunc1();

};

Child2 Class

In-Memory Layout of

Inherited Objects

Lowest Memory

Address

Highest Memory

Address

Child2 Class Instance

BaseMember1

Child1Member1

Child2Member1

Child1 Class Instance

BaseMember1

Pointer to

Child1::VirtualFunc2()

Pointer to

Child1::VirtualFunc1() { ... }; Child1::VirtualFunc1()

Child1::VirtualFunc2() { ... };

Child1 Class

vftable

Child1 Class

Implementations

Pointer to BaseFunc2

Pointer to BaseFunc1

Child2 Class

vftable

Vftable Pointer

Vftable Pointer

Child2::VirtualFunc1() { ... };

Child2::VirtualFunc2() { Not Implemented };

Child2 Class

Implementations

Child1Member1

Base::VirtualFunc1() { ... };

Base::VirtualFunc2() { ... };

Base Class

Implementations

558 Appendix C

23_574817 appc.qxd 3/16/05 8:45 PM Page 558