C++多重继承汇编分析

关注

原创最新推荐文章于 2026-04-19 22:34:50 发布 1k 阅读 AI 写同款· GEO 优化 ›

《C++反汇编与逆向分析技术揭秘》笔记-第12章从内存角度看继承和多重继承 C++反汇编揭秘阅读详情

class CSofa{
public:
CSofa(){
m_nColor = 2;
}

virtual ~CSofa(){
printf("virtual ~CSofa()\r\n");
}

virtual int GetColor(){
return m_nColor;
}

virtual void SitDown(){
printf("CSofa::Sit Down\r\n");
}
protected:
int m_nColor;
};

class CBed{
public:
CBed(){
m_nLength = 4;
m_nWidth = 5;
}

virtual ~CBed(){
printf("virtual ~CBed()\r\n");
}

virtual int GetArea(){
return m_nLength*m_nWidth;
}

virtual void Sleep(){
printf("go to Sleep\r\n");
}

protected:
int m_nLength;
int m_nWidth;

};

class CSofaBed: public CSofa,public CBed{
public:
CSofaBed(){
m_nHeight = 6;
}

virtual ~CSofaBed(){
printf("virtual ~CSofaBed()\r\n");
}

virtual void SitDown(){
printf("CSofaBed::Sit Down\r\n");
}

virtual void Sleep(){
printf("CSofaBed::go to Sleep\r\n");
}

virtual int GetHeight(){
return m_nHeight;
}

protected:
int m_nHeight;
};

int main(int argc, char* argv[])
{
CSofaBed SofaBed;

return 0;

}

多重继承类CSofaBed在内存中的布局

0042501C 50 10 40 00 jmp CSofaBed::`vector deleting destructor' (00401790)
00425020 32 10 40 00 jmp CBed::GetArea (00401410)
00425024 19 10 40 00 jmp CSofaBed::Sleep (00401690)
00425028 00 00 00 00

0042502C 0F 10 40 00 jmp CSofaBed::`scalar deleting destructor' (00401720)
00425030 1E 10 40 00 jmp CSofa::GetColor (004012b0)
00425034 05 10 40 00 jmp CSofaBed::SitDown (00401640)
00425038 3C 10 40 00 jmp CSofaBed::GetHeight (004016e0)
0042503C 00 00 00 00

CSofa类中内存中的布局

00425040 23 10 40 00 jmp CSofa::`scalar deleting destructor' (00401340)
00425044 1E 10 40 00 jmp CSofa::GetColor (004012b0)
00425048 14 10 40 00 jmp CSofa::SitDown (004012f0)
0042504C 00 00 00 00

CBed类在内存中的布局
00425080 5A 10 40 00 jmp CBed::`scalar deleting destructor' (004014a0)
00425084 32 10 40 00 jmp CBed::GetArea (00401410)
00425088 2D 10 40 00 jmp CBed::Sleep (00401450)
0042508C 00 00 00 00

SofaBed类对象在内存中的布局

- &SofaBed 0x0012ff30
- CSofa {...}
+ __vfptr 0x0042502c const CSofaBed::`vftable'{for `CSofa'}
m_nColor 0x00000002
- CBed {...}
+ __vfptr 0x0042501c const CSofaBed::`vftable'{for `CBed'}
m_nLength 0x00000004
m_nWidth 0x00000005
m_nHeight 0x00000006
sizeof(SofaBed)0x00000018

0012FF30 2C 50 42 00
0012FF34 02 00 00 00
0012FF38 1C 50 42 00
0012FF3C 04 00 00 00
0012FF40 05 00 00 00
0012FF44 06 00 00 00

CSofaBed类的构造函数汇编：

55: class CSofaBed: public CSofa,public CBed{
56: public:
57: CSofaBed(){
00401140 push ebp
00401141 mov ebp,esp
00401143 push 0FFh
00401145 push offset __ehhandler$??0CSofaBed@@QAE@XZ (00413919)
0040114A mov eax,fs:[00000000]
00401150 push eax
00401151 mov dword ptr fs:[0],esp
00401158 sub esp,44h
0040115B push ebx
0040115C push esi
0040115D push edi
0040115E push ecx
0040115F lea edi,[ebp-50h]
00401162 mov ecx,11h
00401167 mov eax,0CCCCCCCCh
0040116C rep stos dword ptr [edi]
0040116E pop ecx
0040116F mov dword ptr [ebp-10h],ecx
00401172 mov ecx,dword ptr [ebp-10h]
00401175 call @ILT+70(CSofa::CSofa) (0040104b) ; 在地址0012FF30处写入00425040
0040117A mov dword ptr [ebp-4],0
00401181 mov ecx,dword ptr [ebp-10h]
00401184 add ecx,8
00401187 call @ILT+95(CBed::CBed) (00401064) ; 在地址0012FF38处写入00425080
0040118C mov eax,dword ptr [ebp-10h]
0040118F mov dword ptr [eax],offset CSofaBed::`vftable' (0042502c); 在地址0012FF30处写入0042502c
00401195 mov ecx,dword ptr [ebp-10h]
00401198 mov dword ptr [ecx+8],offset CSofaBed::`vftable' (0042501c); 在地址0012FF38处写入0042501C
58: m_nHeight = 6;
0040119F mov edx,dword ptr [ebp-10h]
004011A2 mov dword ptr [edx+14h],6
59: }
004011A9 mov dword ptr [ebp-4],0FFFFFFFFh
004011B0 mov eax,dword ptr [ebp-10h]
004011B3 mov ecx,dword ptr [ebp-0Ch]
004011B6 mov dword ptr fs:[0],ecx
004011BD pop edi
004011BE pop esi
004011BF pop ebx
004011C0 add esp,50h
004011C3 cmp ebp,esp
004011C5 call __chkesp (004017a0)
004011CA mov esp,ebp
004011CC pop ebp
004011CD ret

SofaBed类对象在内存中的布局

0012FF30 2C 50 42 00
0012FF34 02 00 00 00
0012FF38 1C 50 42 00
0012FF3C 04 00 00 00
0012FF40 05 00 00 00
0012FF44 06 00 00 00

CSofaBed对象的析构函数

61: virtual ~CSofaBed(){
00401570 push ebp
00401571 mov ebp,esp
00401573 push 0FFh
00401575 push offset __ehhandler$??1CSofaBed@@UAE@XZ (00413939)
0040157A mov eax,fs:[00000000]
00401580 push eax
00401581 mov dword ptr fs:[0],esp
00401588 sub esp,48h
0040158B push ebx
0040158C push esi
0040158D push edi
0040158E push ecx
0040158F lea edi,[ebp-54h]
00401592 mov ecx,12h
00401597 mov eax,0CCCCCCCCh
0040159C rep stos dword ptr [edi]
0040159E pop ecx
0040159F mov dword ptr [ebp-10h],ecx
004015A2 mov eax,dword ptr [ebp-10h]
004015A5 mov dword ptr [eax],offset CSofaBed::`vftable' (0042502c)   ; 在地址0012FF30处写入0042502c
004015AB mov ecx,dword ptr [ebp-10h]
004015AE mov dword ptr [ecx+8],offset CSofaBed::`vftable' (0042501c) ; 在地址0012FF38处写入0042501C
004015B5 mov dword ptr [ebp-4],0
62: printf("virtual ~CSofaBed()\r\n");
004015BC push offset string "virtual ~CSofaBed()\r\n" (004250b8)
004015C1 call printf (00401cb0)
004015C6 add esp,4
63: }
004015C9 cmp dword ptr [ebp-10h],0
004015CD je CSofaBed::~CSofaBed+6Ah (004015da)
004015CF mov edx,dword ptr [ebp-10h]
004015D2 add edx,8
004015D5 mov dword ptr [ebp-14h],edx
004015D8 jmp CSofaBed::~CSofaBed+71h (004015e1)
004015DA mov dword ptr [ebp-14h],0
004015E1 mov ecx,dword ptr [ebp-14h]
004015E4 call @ILT+50(CBed::~CBed) (00401037)   ; 在地址0012FF38处写入00425080
004015E9 mov dword ptr [ebp-4],0FFFFFFFFh
004015F0 mov ecx,dword ptr [ebp-10h]
004015F3 call @ILT+90(CSofa::~CSofa) (0040105f)    ; 在地址0012FF30处写入00425040
004015F8 mov ecx,dword ptr [ebp-0Ch]
004015FB mov dword ptr fs:[0],ecx
00401602 pop edi
00401603 pop esi
00401604 pop ebx
00401605 add esp,54h
00401608 cmp ebp,esp
0040160A call __chkesp (004017a0)
0040160F mov esp,ebp
00401611 pop ebp
00401612 ret