I have the following structure in a piece of code (compiled on x86):
0:012> dt prog!_TESTSTRUCT
+0x000 __VFN_table : Ptr32
+0x008 szAddr : Ptr32 Wchar
+0x00c szOpCode : Ptr32 Wchar
+0x010 szMnemonic : Ptr32 Wchar
+0x014 szArgs : Ptr32 Wchar
+0x018 addr : Uint8B
+0x020 nextOffset : Uint8B
As you can see, vtable ptr, although the size is 4 bytes, is 8 bytes.
For reference, here is another structure from the same piece of code that is usually aligned:
0:012> dt prog!_TESTSTRUCT2
+0x000 __VFN_table : Ptr32
+0x004 pClient : Ptr32 IDebugClient5
+0x008 pDebugControl : Ptr32 IDebugControl4
+0x00c pDebugSystemObjects : Ptr32 IDebugSystemObjects
+0x010 pDebugDataSpaces : Ptr32 IDebugDataSpaces
+0x014 pDebugSymbols : Ptr32 IDebugSymbols3
+0x018 handlesAcquired : Bool
Why does 32bit ptr on x86 correspond to 8 bytes in the first structure? What am I missing here?
EDIT 1:
class _TESTSTRUCT size(40):
1> +---
1> 0 | {vfptr}
1> 8 | szAddr
1> 12 | szOpCode
1> 16 | szMnemonic
1> 20 | szArgs
1> 24 | addr
1> 32 | nextOffset
1> +---
1>
1> _TESTSTRUCT::$vftable@:
1> | &_TESTSTRUCT_meta
1> | 0
1> 0 | &_TESTSTRUCT::{dtor}
1>
1> _TESTSTRUCT::{dtor} this adjustor: 0
1> _TESTSTRUCT::__delDtor this adjustor: 0
1> _TESTSTRUCT::__vecDelDtor this adjustor: 0
class _TESTSTRUCT2 size(28):
1> +---
1> 0 | {vfptr}
1> 4 | pDebugClient
1> 8 | pDebugControl
1> 12 | pDebugSystemObjects
1> 16 | pDebugDataSpaces
1> 20 | pDebugSymbols
1> 24 | handlesAcquired
1> | <alignment member> (size=3)
1> +---
1>
1> _TESTSTRUCT2::$vftable@:
1> | &_TESTSTRUCT2_meta
1> | 0
1> 0 | &_TESTSTRUCT2::{dtor}
1>
1> _TESTSTRUCT2::{dtor} this adjustor: 0
1> _TESTSTRUCT2::__delDtor this adjustor: 0
1> _TESTSTRUCT2::__vecDelDtor this adjustor: 0
source
share