1.代碼
#include<iostream>
using namespace std;
class A
{
public:
virtual void fun1(){ cout<<"A::fun1"<<endl;}
virtual void fun2(){cout<<"A::fun2"<<endl;}
};
class B : public A
{
public:
virtual void fun1(){ cout<<"B::fun1"<<endl;}
virtual void fun2(){cout<<"B::fun2"<<endl;}
};
void main(){
void (A::*f1)();
void (A::*f2)();
A *p=new B;
f1 = &A::fun1;
f2 = &A::fun2;
(p->*f1)();
(p->*f2)();
printf("f1 = %p f2 = %p\n", f1, f2);
printf("B::fun1 = %p, B::fun2 = %p\n", &A::fun1, &A::fun2);
delete p;
system("pause");
}2.結果
B::fun1
B::fun2
f1 = 004010AA f2 = 004010B4
B::fun1 = 004010AA, B::fun2 = 004010B4
3.解惑
i. 如果對于為什么f = A::funx 卻輸出的是B::funx？
ii. 為什么A::funx = B::funx
以上兩個問題可以當作是一個，看看匯編就知道了，他們將生成一個虛函數的選擇函數，短小的函數負責選對應虛函數中的位置，根據對象的虛函數表而定，所以....
4.匯編
debug
0040121E . C745 F0 AA104>mov dword ptr [ebp-10], 004010AA
00401225 . C745 EC B4104>mov dword ptr [ebp-14], 004010B4
0040122C . 8BF4 mov esi, esp
0040122E . 8B4D E8 mov ecx, [ebp-18]
00401231 . FF55 F0 call [ebp-10]
00401234 . 3BF4 cmp esi, esp
00401236 . E8 A5870000 call _chkesp
0040123B . 8BF4 mov esi, esp
0040123D . 8B4D E8 mov ecx, [ebp-18]
00401240 . FF55 EC call [ebp-14]
00401243 . 3BF4 cmp esi, esp
00401245 . E8 96870000 call _chkesp
0040124A . 8B55 EC mov edx, [ebp-14]
0040124D . 52 push edx ; /<%p>
0040124E . 8B45 F0 mov eax, [ebp-10] ; |
00401251 . 50 push eax ; |<%p>
00401252 . 68 48404300 push 00434048 ; |format = "f1 = %p f2 = %p",LF,""
00401257 . E8 14820000 call printf ; \printf
0040125C . 83C4 0C add esp, 0C
0040125F . 68 B4104000 push 004010B4 ; /<%p> = Cplusplu.004010B4
00401264 . 68 AA104000 push 004010AA ; |<%p> = Cplusplu.004010AA
00401269 . 68 24404300 push 00434024 ; |format = "B::fun1 = %p, B::fun2 = %p",LF,""
0040126E . E8 FD810000 call printf ; \printf
00402300 > > \8B01 mov eax, [ecx] // 第一個虛函數
00402302 . FF20 jmp [eax]
00402304 CC int3
00402305 CC int3
00402306 CC int3
00402307 CC int3
00402308 CC int3
00402309 CC int3
0040230A CC int3
0040230B CC int3
0040230C CC int3
0040230D CC int3
0040230E CC int3
0040230F CC int3
00402310 > > 8B01 mov eax, [ecx] // 第二個虛汗數
00402312 . FF60 04 jmp [eax+4]
release
posted on 2008-03-08 18:12
margin 閱讀(304)
評論(0) 編輯 收藏 引用 所屬分類:
C/C++ 、
逆向工程