Using undocumented classes in C ++

I am reverse engineering a Windows executable. I found a class that I want to use from some code that I insert into the executable (another thread, own stack). How can I declare such a class, given the addresses of methods and the structure of member variables?

For example, let's say I found a class called foo, with it the constructor @ 0x4012D30 and the function doTheMario @ 40125D4. I also know that it contains three private data DWORDs. Since both methods are common, I declare such a class in my code:

class GuessedFoo {
    private:
        int bar;
        char *cafebabe;
        float deadbeef;
    public:
        GuessedFoo(int a, int b);
        void doTheMario();
};

Now, this class is great dandy, but is there now a way to get the compiler / linker to bind class methods to the two previous addresses that I have outlined? Of course, I can write an asm shell to convert stdcall to thiscall for each method I need to use, and then use structures instead of classes, but there should be a better way.

I am using gcc / g ++ at the moment, but I can switch to VC ++ (since gcc inline asm gives me headaches).

+3
source share
4 answers

vtable, , . , - , .

vtable, ; , , vtable . ; , . , , - win32 ; , - . - , , , -, , vtable. !

+4

, (, ), .

.
EXE , .
:

void main()
{
    int bar = 5;
    int * cafebabe = &bar;
    __asm
    {
        push [bar];
        push [cafebabe];
        mov eax, 123456; // address of the function
        call eax;
    }
}

, , , . , , , !

+1

, , : , " " - .

0

++ - , ++.

, , : , c typedefs , - .

, __thiscall 'this' ecs, , c, , "CallThisCallMethodWithParameters", .

0

Source: https://habr.com/ru/post/1758322/


All Articles