First analyze an example.
#include <stdio.h>class cbase{public:cbase () {printf ("cbase\n");} ~cbase () {printf ("~cbase\n");} void Setnumber (int nInt) {this->m_nnumber = nInt;} int GetNumber () {return this->m_nnumber;} Private:int M_nnumber;}; Class Cderive:public cbase{public:void shownumber (int nnumber) {setnumber (nnumber); m_nderive = Nnumber + 1;printf ("%d\n ", GetNumber ());p rintf ("%d\n ", m_nderive);} Public:int m_nderive;}; int main1 (int argc, char *argv[]) {cderive derive;derive. Shownumber (argc); return 0;} int main3 () {int ntest = 0x87654321; CBase Base; Cderive *pderive = (cderive *) (&base);p rintf ("%x\n", pderive->m_nderive); return 0;}
The following is an disassembly analysis
Here is the function jump table @ilt+0 ([email protected]@@[email protected]): 00401005 jmp cbase::setnumber (00401190) @ILT +5 ([E Mail protected]@[email protected]): 0040100A jmp cbase::~cbase (00401300) @ILT +10 ([email protected] @@[email protected]): 0040100F jmp cderive::shownumber (00401100) @ILT +15 ([email protected]@ @QAEHXZ): 004 01014 jmp Cbase::getnumber (004011d0) @ILT +20 ([email protected]@[email protected]): 00401019 jmp Cderive::cderive (00401210) @ILT +25 ([email protected]@[email protected]): 0040101E jmp Cderive::~cder Ive (004012b0) @ILT +30 (_main): 00401023 jmp Main (00401060) @ILT +35 ([email protected]@[email protected]): 00401028 jmp cbase::cbase (00401260) cderive::cderive:00401210 push ebp00401211 mov ebp,esp004 01213 Sub esp,44h00401216 push ebx00401217 push esi00401218 push edi00401219 push ECX0040121A Lea EDI,[EBP-44H]0040121D mov ecx,11h00401222 mov eax,0cccccccch00401227 rep stos dword ptr [ edi]00401229 pop ecx0040122a mov dword ptr [EBP-4],ECX ecx is the this pointer 0040122D mov Ecx,dword PTR [ebp-4]00401230 call @ILT +35 (cbase::cbase) (00401028) 00401235 mov eax,dword ptr [ebp-4]00401238 Pop edi00401239 pop esi0040123a pop ebx0040123b add esp,44h0040123e cmp EB p,esp00401240 call __chkesp (00401730) 00401245 mov esp,ebp00401247 pop ebp00401248 retcderi ve::~cderive:004012b0 Push EBP004012B1 mov ebp,esp004012b3 sub esp,44h004012b6 push EBX004012B7 push esi004012b8 push edi004012b9 push ECX004012BA Lea edi,[ebp-44h]00401 2BD mov ECX,11H004012C2 mov eax,0cccccccch004012c7 rep stos dword ptr [EDI]004012C9 Pop ECX004012CA mov DWORD ptr [EBP-4],ECX004012CD mov ecx,dword ptr [ebp-4]004012d0 call @ILT +5 (cbase::~cbase) (0040100a ) 004012d5 pop edi004012d6 pop esi004012d7 pop ebx004012d8 add esp,44h004012db cm P EBP,ESP004012DD Call __chkesp (00401730) 004012E2 mov esp,ebp004012e4 pop ebp004012e 5 Ret1: #include <stdio.h>2:3: Class CBase4: {5:public:6: CBase () 00401260 push ebp0040 1261 mov ebp,esp00401263 Sub esp,44h00401266 push ebx00401267 push esi00401268 pus H edi00401269 push ecx0040126a Lea edi,[ebp-44h]0040126d mov ecx,11h00401272 mov EAX,0CCCCCCCCH00401277 Rep stos dword ptr [edi]00401279 pop ecx0040127a mov dword ptr [ebp-4 ],ECX7: {8:printf ("cbase\n"); 0040127D push offset string "cbase\n" (00425020) 00401282 call printf (00401860) 00401287 add esp,49:}0040128a mov eax,dword ptr [ebp-4]0040128d pop edi0040128e Pop esi0040128f pop ebx00401290 Add esp,44h00401293 cmp ebp,esp00401295 Call _ _chkesp (00401730) 0040129A mov esp,ebp0040129c pop ebp0040129d ret10: ~cbase () 11: {00401 $ push ebp00401301 mov ebp,esp00401303 sub esp,44h00401306 push ebx00401307 push esi00401308 push edi00401309 push ecx0040130a Lea edi,[ebp-44h]0040130d mov ECX,11H00401312 mov eax,0cccccccch00401317 rep stos dword ptr [edi]00401319 pop ecx Restore ECX pointer 0040131A mov dword ptr [ebp-4],ecx12:printf ("~cbase\n"); 0040131D push offset string " ~cbase\n "(00425028) 00401322 call printf (00401860) 00401327 add esp,413:}0040132a pop edi0040132b Pop esi0040132c pop ebx0040132d Add esp,44h00401330 cmp ebp,esp00401332 call __chkesp (00401730) 00401337 mov esp,ebp00401339 pop ebp0040133a ret14:void setnumber (int nInt) 15: {00401190 Push ebp00401191 mov ebp,esp00401193 sub esp,44h00401196 push ebx004011 esi00401198 push edi00401199 push ecx0040119a Lea EDI,[EBP-44H]0040119D mov ECX,11H004011A2 mov eax,0cccccccch004011a7 rep stos dword ptr [edi]004011a9 pop ecx00401 1AA mov dword ptr [ebp-4],ecx16:this->m_nnumber = NINT;004011AD mov eax,dword ptr [ebp-4 ]004011B0 mov ecx,dword ptr [ebp+8]004011b3 mov dword ptr [eax],ecx17:}004011b5 pop E Di004011b6 pop esi004011b7 pop ebx004011b8 mov esp,ebp004011ba pop ebp004011bb r ET 418:inT GetNumber (): {004011d0 push EBP004011D1 mov ebp,esp004011d3 sub esp,44h004011d6 p Ush ebx004011d7 push esi004011d8 push edi004011d9 push ecx004011da Lea Edi,[eb P-44H]004011DD mov ecx,11h004011e2 mov eax,0cccccccch004011e7 rep stos dword ptr [Edi]004011e9 Pop Ecx004011ea mov dword ptr [Ebp-4],ecx20:return this->m_nnumber;004011ed mov Eax,dword ptr [ebp-4]004011f0 mov eax,dword ptr [eax]21:}004011f2 pop edi004011f3 Pop ESI004011F4 pop ebx004011f5 mov esp,ebp004011f7 pop ebp004011f8 ret22:private:23: int m_nnumber;24:};25:26:class cderive:public CBase27: {28:public:29:void shownumber (int nnumber) 30: {00401100 Push ebp00401101 mov ebp,esp00401103 sub esp,44h00401106 push ebx00 401107 push ESI00401108 push edi00401109 push ecx0040110a Lea EDI,[EBP-44H]0040110D mov ecx,11h0040 1112 MOV eax,0cccccccch00401117 rep stos dword ptr [edi]00401119 pop ecx0040111a mov DW Ord ptr [Ebp-4],ecx31:setnumber (nnumber); 0040111D mov eax,dword ptr [ebp+8]00401120 push eax 00401121 mov ecx,dword ptr [ebp-4]00401124 call @ILT +0 (cbase::setnumber) (00401005) 32:m_nder ive = nnumber + 1;00401129 mov ecx,dword ptr [ebp+8]0040112c add ecx,10040112f mov edx,dword PTR [ebp-4]00401132 mov dword ptr [edx+4],ecx33:printf ("%d\n", GetNumber ()); 00401135 mov Ecx,dword ptr [ebp-4]00401138 call @ILT +15 (cbase::getnumber) (00401014) 0040113D push eax0040113e push Offset string "%d\n" (0042501c) 00401143 call printf (00401860) 00401148 add ESP,834:PR intf ("%d\n", m_nderive)0040114B mov eax,dword ptr [ebp-4]0040114e mov ecx,dword ptr [eax+4]00401151 push ecx0040115 2 Push offset string "%d\n" (0042501c) 00401157 call printf (00401860) 0040115C add esp,835: }0040115f pop edi00401160 pop esi00401161 pop ebx00401162 add esp,44h00401165 CMP ebp,esp00401167 call __CHKESP (00401730) 0040116C mov esp,ebp0040116e pop ebp0040 116F ret 436:private:37:int m_nderive;38:};39:40:int main (int argc, char *argv[]) 41: {0040106 0 Push ebp00401061 mov ebp,esp00401063 push 0ffh00401065 push offset __ehhandler$_mai N (00413429) 0040106A mov eax,fs:[00000000]00401070 push eax00401071 mov dword ptr fs:[0],esp0 0401078 Sub esp,4ch0040107b push ebx0040107c push esi0040107d push edi0040107e Lea edi,[ebp-58h]00401081 mov ecx,13h00401086 mov eax,0cccccccch0040108b rep stos dword ptr [Edi]42:cderive de rive;0040108d Lea ecx,[ebp-14h]00401090 call @ILT +20 (cderive::cderive) (00401019) 00401095 mov DWORD ptr [Ebp-4],043:derive. Shownumber (ARGC); 0040109C mov eax,dword ptr [ebp+8]0040109f push eax004010a0 Lea ecx,[ebp-14h ]004010A3 call @ILT +10 (cderive::shownumber) (0040100f) 44:return 0;004010A8 mov dword ptr [ebp-18 H],0004010AF mov dword ptr [ebp-4],0ffffffffh004010b6 Lea ecx,[ebp-14h]004010b9 call @ILT +25 ( cderive::~cderive) (0040101e) 004010BE mov eax,dword ptr [ebp-18h]45:}004010C1 mov ecx,dword ptr [eb P-0CH]004010C4 mov dword ptr fs:[0],ecx004010cb pop edi004010cc pop esi004010cd pop EBX004010CE Add esp,58h004010d1 cmp ebp,esp004010d3 call __CHKESP (00401730) 004010D8 mov esp,ebp004010da pop ebp004010db ret parent class has a constructor subclass no then the compiler provides a default. Subclasses that have a parent class are not necessarily provided. Unless there are virtual functions and so on. 46:int Main (): {00401360 push ebp00401361 mov ebp,esp00401363 Sub esp,50h00401366 pu SH ebx00401367 push esi00401368 push edi00401369 Lea EDI,[EBP-50H]0040136C mov ECX,14H00401371 mov eax,0cccccccch00401376 rep stos dword ptr [Edi]48:int ntest = 0x87654321;00401 378 mov dword ptr [ebp-4],87654321h49:cbase base;0040137f Lea ecx,[ebp-8]00401382 Call @ILT +40 (cbase::cbase) (0040102d) 50:cderive *pderive = (cderive *) (&base); 00401387 Lea eax,[ebp-8]004 0138A mov dword ptr [ebp-0ch],eax51:printf ("%x\n", pderive->m_nderive); 0040138D mov Ecx,dwo RD ptr [ebp-0ch]00401390 mov edx,dword ptr [ecx+4]//pointer offset, note here is pointer offset, pointer can be NULL NULL + 4 is NOT NULL, NULL pointer exception not present 00401393 Push edx00401394 push Offset string "%x\n" (00425034) 00401399 call printf (00401930) 0040139E add Esp,852:return 0;004013A1 mov dword ptr [ebp-10h],0004013a8 Lea Ecx,[ebp-8]004013ab call @ILT +5 (Cbase::~cbas e) (0040100a) 004013b0 mov eax,dword ptr [ebp-10h]53:}004013b3 pop edi004013b4 pop esi0040 13B5 pop ebx004013b6 Add esp,50h004013b9 cmp ebp,esp004013bb call __CHKESP (0040180 0) 004013c0 mov esp,ebp004013c2 pop ebp004013c3 ret
The base class for the inheritance of CPP disassembly