just wanna post some of my examples here, and see if anybody likes them (though they are inline assembler examples that can easily be modified to call in memory C++ objects from ASM code in the same process, also maybe people might be able to point out some errors in my logic or understanding. b.t.w these are MSVC++ specific as other compilers probably implement things differently.. one thing to note is i haven't tested/made allowances for classes that use multiple inheritence
first issue is getting a pointer to the method. The folowing inline assembly will do it for virtual and non virtual methods, however it won't do it if you only have an empty "shell interface" definiton of the class (i.e virtual BOOL Shutdown() = 0;
Code: Select all
_asm
{
mov eax,Test::DoIt;
}
first thing you need to do is use a method pointer..
Code: Select all
//here is what the method actually looks like for reference
virtual long DoIt(long x);
...
// and now we need to declare a pointer to a method
long (Test::*pfn2)(long x); //method pointer
// and now set the method pointer.
pfn2 = &Test::DoIt;
// now do the impossible, cast a method pointer as a function pointer
void * ptr = *((void **)&pfn2 );
that stub always (as far as i've seen) looks like this
Code: Select all
//00401EF0 8B 01 mov eax,dword ptr [ecx]
//00401EF2 FF 60 04 jmp dword ptr [eax+4]
so i've this routine here that call be called on the address we got from the method pointer to see if it points to a virtual or non virtual method
Code: Select all
static BOOL ismethodptrvirtual(void * methodptr)
{
BOOL returnval;
_asm
{
mov eax,methodptr;
mov ebx,[eax]
mov eax,TRUE
cmp ebx,60FF018Bh
je skip
mov eax,FALSE
skip:
mov returnval,eax
}
return returnval;
}
myobj->doit(1); in a test app, and see the Assembly that msvc++ produces (or debug the app to see it).also the offset is goign to be DWORD aligned so first method be at offset 4, 2nd at offset 8 etc..
anyhow i made this function to go inside the virtual table and get the adddress of a virtual method based on the instance and offset.
Code: Select all
static PVOID virtualaddress(void* thisptr,int methodoffset)
{
PVOID returnval;
_asm
{
mov eax,thisptr;
mov eax,[eax] ; //point to the start of virtualtable
mov ebx,methodoffset;
mov eax,[eax+ebx*4]
mov returnval,eax
}
return returnval;
}
nonstaTIC C++ methods use the THISCALL calling convention which is basically the STDCALL (called method cleans up the stack) with the hidden 'this' instance pointer also being sent, with MSVC++ the 'this' pointer is passed in ECX register.. and all the parameters like STDCALL are pushed on the the stack in right to left order. (but since the stack goes downwards, basically in memory in left to right order ) so if you want to call
this particular method manually you could do.. the return value is normally returned in eax, but 8 bit structures are returned in eax:edx, and floats are returned in ST0 - so will have to be accessed seperately, not covered in this article
Code: Select all
// to do the equivilant of the following
// int mine = obj1.doIt(43);
//where you allready have the pointer to doIt in PVOID doitptr;
_asm
{
push 43
mov ecx,obj1
call [doitptr]
mov mine,eax
}
first this is how it is called.
Code: Select all
//here is the definition of the method used in this example
virtual BOOL Startup(HWND hPrimaryWnd, DWORD modeFlags);
// and i know that it is the first method in the virtual table, and we have an instance of this class called
//m_pEngine
//here is the structure containing the parameters to pass to the function
struct
{
HWND wndhandle;
DWORD c;
} mystruct = {tmphwnd,VJEMODE_PRESENTATION};
//use the virtualaddress method we have already covered to get the address from the instance.
address = (DWORD) thiscall::virtualaddress(m_pEngine,1);
//use the my callmethod passing in the instance of the object, the adress, the structure containing
//the arguments for the function and the size of the arugments (structure)
thiscall::callmethod(m_pEngine,address,(const void*)&mystruct,sizeof(mystruct));
Code: Select all
static DWORD callmethod(void* thisptr, DWORD address,const void* arguments,size_t argsize)
{
DWORD returnval;
_asm
{
mov ecx, argsize // get size of arguments for the function
sub esp, ecx // adjust the stack pointer to give room to copy these arguments there
shr ecx, 2 // divide by 4 (because we'll copy DWORDS over at a time)
mov esi, arguments // get the pointer to the start of the arguments buffer (Source)
mov edi, esp // start of destination stack frame (destination)
rep movsd // copy arugments to stack frame
mov ecx, thisptr // THISCALL passes "this" in ecx
call [address] // call the function
mov returnval, eax // return value returns in eax, so we better save it
}
return returnval;
}
Code: Select all
static DWORD callvirtualmethod(void *thisptr,int methodoffset,const void* arguments,size_t argsize)
{
DWORD returnval;
_asm
{
mov ecx, argsize // get size of arguments for the function
sub esp, ecx // adjust the stack pointer to give room to copy these arguments there
shr ecx,2 // divide by 4 (because we'll copy DWORDS over at a time)
mov esi, arguments // get the pointer to the start of the arguments buffer (Source)
mov edi, esp // start of destination stack frame (destination)
rep movsd // copy arugments to stack frame
mov eax, thisptr // get the "this" pointer
mov eax, [eax] // point to the start of virtualtable
mov ebx, methodoffset // offset into the virtualtable
mov ecx, thisptr // THISCALL passes "this" in ecx
call [eax+ebx*4] // call the function (the address of virtualtable+offset*4)
mov returnval, eax // return value returns in eax, so we better save it
}
return returnval;
}
Code: Select all
//instead of the following used in the last example
address = (DWORD) thiscall::virtualaddress(m_pEngine,1);
thiscall::callmethod(m_pEngine,address,(const void*)&mystruct,sizeof(mystruct));
//you can just do this directly
thiscall::callvirtualmethod(m_pEngine,1,(const void*)&mystruct,sizeof(mystruct));
Code: Select all
//00401EF0 8B 01 mov eax,dword ptr [ecx]
//00401EF2 FF 60 04 jmp dword ptr [eax+4]
Code: Select all
static PVOID dereferencemethodptr(void* thisptr,void * methodptr)
{
PVOID returnval;
//issues if size of pointer is more than 4 bytes (multiple inheritance it might be different)
//if a method pointer points to a nonstatic (but not virtual) function, then it points directly
//to that function
//if it points to a nonstatic VIRTUAL function, then it points to a stub that C++ creates that looks
//the the following
//00401EF0 8B 01 mov eax,dword ptr [ecx]
//00401EF2 FF 60 04 jmp dword ptr [eax+4]
//as far as i've seen , irregardless of anything i've seen so far , or compiler optomisation options
//it seems to be exactly the same as above, other than the last byte (the +4) which is actually the information
//we need to be able to look up the function in the vtable.. so we can read it directly from this code.
//so first we check to see if the first 4 bytes are 8b01FF60 (or is it 60FF018B?) and if it is grab the
//address + 4.. otherwise just treat the address as what it is.
_asm
{
mov eax,methodptr;
mov ebx,[eax]
cmp ebx,60FF018Bh
jne skip
//if its a virtual method
xor ebx,ebx
mov bl,byte ptr [eax + 4]; //grab the 5th byte which is the +4 (or +whatever) offset in the virtual table
mov eax,thisptr; //ptr to the instance of the class
mov eax,[eax] ;//start of virtual table
mov eax,[eax+ebx];//get the address of the method from getting it from the virtual table with offset
skip:
mov returnval,eax
}
return returnval;
}