Reversing : The Hacker's Guide to Reverse Engineering

(ff) #1
InheritedClass::InheritedClass()
push ebp
mov esp, ebp
sub esp, 8
mov [ebp - 4], ebx
mov ebx, [ebp + 8]
mov [esp], ebx
call BaseConstructor
mov [ebx + 4], 0
mov [ebx], InheritedVFTable
mov ebx, [ebp - 4]
mov esp, ebp
pop ebp
ret

Notice how the constructor actually calls the base class’s constructor. This is
how object initialization takes place in C++. An object is initialized and the
constructor for its specific type is called. If the object is inherited, the compiler
adds calls to the ancestor’s constructor before the beginning of the descen-
dant’s actual constructor code. The same process takes place in each ancestor’s
constructor until the base class is reached. Here is an example of a base class
constructor:

BaseClass::BaseClass()
push ebp
mov ebp, esp
mov edx, [ebp + 8]
mov [edx], BaseVFTable
mov [edx + 4], 0
mov [edx + 8], 0
pop ebp
ret

Notice how the base class sets the virtual function pointer to its own copy
only to be replaced by the inherited class’s constructor as soon as this function
returns. Also note that this function doesn’t call any other constructors since it
is the base class. If you were to follow a chain of constructors where each call
its parent’s constructor, you would know you reached the base class at this
point because this constructor doesn’t call anyone else, it just initializes the vir-
tual function table and returns.

560 Appendix C

23_574817 appc.qxd 3/16/05 8:45 PM Page 560

Free download pdf