Reversing : The Hacker's Guide to Reverse Engineering

the descendant’s specific type it knows to skip the base class (and any other

descendants present) in order to reach the inherited object. All of this behavior

is embedded into the machine code by the compiler based on which object

type is accepted by that function. The inherited class memory layout is

depicted in Figure C.5.

Class Methods

Conventional class methods are essentially just simple functions. Therefore, a

nonvirtual member function call is essentially a direct function call with the

thispointer passed as the first parameter. Some compilers such as Intel’s and

Microsoft’s always use the ECXregister for the thispointer. Other compilers

such G++ (the C++ version of GCC) simply push thisinto the stack as the

first parameter.

Figure C.5 Layout of inherited objects in memory.

class Base{

int BaseMember1;int BaseMember2;

};

Base Class

class Child1 : Base{

int Child1Member1;int Child1Member2;

};

Child1 Class

class Child2 : Child1

{ int Child2Member1;

int Child2Member2;

};

Child2 Class

class OtherChild : Base

{ int OtherChildMember1;

}; int OtherChildMember2;

OtherChild Class

In-Memory Layout of

Inherited Objects

Child2 Class Instance

BaseMember1

BaseMember2

Child1Member1

Child1Member2

Child2Member1

Child2Member2

OtherChild Class Instance

BaseMember1

BaseMember2

OtherChildMember1

OtherChildMember2

Lowest Memory

Address

Highest Memory

Address

BaseMember1

BaseMember2

Base Class Instantiation

556 Appendix C

23_574817 appc.qxd 3/16/05 8:45 PM Page 556