Книга: Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software
Назад: 20. C++ Analysis
Дальше: Virtual vs. Nonvirtual Functions

.

In object-orientation, code is arranged in user-defined data types called classes. Classes are like structs, except that they store function information in addition to data. Classes are like a blueprint for creating an object—one that specifies the functions and data layout for an object in memory.

When executing object-oriented C++ code, you use the class to create an object of the class. This object is referred to as an instance of the class. You can have multiple instances of the same class. Each instance of a class has its own data, but all objects of the same type share the same functions. To access data or call a function, you must reference an object of that type.

shows a simple C++ program with a class and a single object.

, if we wanted to access the x variable, we would use myObject.x.

shows an example.

, we covered the stdcall, cdecl, and fastcall calling conventions. The C++ calling convention for the this pointer is often called thiscall. Identifying the thiscall convention can be one easy way to identify object-oriented code when looking at disassembly.

, generated from , demonstrates the usage of the this pointer.

.

shows the function TestFunction. IDA Pro demangles the function and shows the original name and parameters.

shows a class called Socket.

, the sendData function at can call the setDestinationAddr function at even though that function is not defined in the UDPSocket class, because the functionality of the parent class is automatically included in the child class.

Inheritance helps programmers more efficiently reuse code, but it’s a feature that does not require any runtime data structures and generally isn’t visible in assembly code.

sss
sss

© RuTLib.com 2015-2018