"The revelation of C + + disassembly and reverse analysis technology"--constructors and destructors

The constructor is called automatically when the object is generated. Whenever a definition object is found, the timing of the constructor call is found. objects of different scopes have different life cycles, such as local objects, global objects, static objects, and so on, so long as you know the declaration period of an object, you can infer the invocation time of the constructor.

• Local objects

Disassembly:

Get the first address of the object and call the constructor:

The address of the object is:

Enter the constructor, first push a heap of registers:

Restore the ECX register and initialize it:

A constructor is a member function that is used to invoke the this pointer.

How to identify? 1, the constructor when the object is called within the scope of the first member function, according to the this pointer can distinguish each object, 2, the return this pointer is one of the characteristics of the constructor (this is necessary to identify the local variable constructor).

• Heap Object

the identification of heap objects is focused on identifying the application and use of heap space .

Example:

Size of new and new:

The address returned:

Call Constructor:

First determine whether new is successful or skip the constructor if it fails:

To execute a constructor initialization object:

Navigate to the first member variable of the object and assign a value of 0XB:

when the new object returns the first address of the object, it also checks whether it is null, makes a judgment, and skips the constructor if it fails, so you can start by finding the constructor for the heap object .

Consider the case where we have two member variables:

New's size has changed:

The positioning changes when assigning a value to the second member variable:

"The revelation of C + + disassembly and reverse analysis technology"--constructors and destructors