Reversing : The Hacker's Guide to Reverse Engineering

the current V_0back into V_0. You can only assume that this sequence origi-

nated in something like CurrentItem = CurrentItem.Nextin the original

source code. Basically, what you’re doing here is going over the entire list and

“dumping” each item in it. You don’t really know what dumping actually

means in this context yet. Because the Dumpmethod in ListItemis declared

as a virtual method, the actual method that is executed here is unknown—it

depends on the specific object type.

The StringItem Class

Let’s conclude this example by taking a quick look at Listing 12.5, at the decla-

ration of the StringItemclass, which inherits from the ListItemclass.

.class private auto ansi beforefieldinit StringItem

extends ListItem

{

.field private string ItemData

.method public hidebysig specialname rtspecialname

instance void .ctor(string InitializeString) cil managed

{

.maxstack 2

IL_0000: ldarg.0

IL_0001: call instance void ListItem::.ctor()

IL_0006: ldarg.0

IL_0007: ldarg.1

IL_0008: stfld string StringItem::ItemData

IL_000d: ret

} // end of method StringItem::.ctor

.method public hidebysig virtual instance void

Dump() cil managed

{

.maxstack 1

IL_0000: ldarg.0

IL_0001: ldfld string StringItem::ItemData

IL_0006: call void [mscorlib]System.Console::Write(string)

IL_000b: ret

} // end of method StringItem::Dump

} // end of class StringItem

Listing 12.5 Declaration of the StringItemclass.

The StringItemclass is an extension of the ListItemclass and contains

a single field: ItemData, which is a string data type. The constructor for

this class takes a single string parameter and stores it in the ItemDatafield.

The Dump method simply displays the contents of ItemData by calling

System.Console::Write. You could theoretically have multiple classes

442 Chapter 12