Questions about reversing object oriented code(initializing vtables in ctors)

Question

I was reversing some C++ code and encountered following function.

sub_106C0A0 proc near

var_10= dword ptr -10h
var_C= dword ptr -0Ch
var_4= dword ptr -4

push    0FFFFFFFFh
push    offset SEH_106C0A0
mov     eax, large fs:0
push    eax
mov     large fs:0, esp
push    ecx
push    esi
mov     esi, ecx
push    edi
lea     edi, [esi+4]
push    30h
mov     ecx, edi
mov     [esp+1Ch+var_10], esi
mov     dword ptr [esi], offset off_12C0680
call    struc_13_ctor
mov     dword ptr [edi], offset off_12C057C ; another vtable init ?

This function passes this pointer of some object (struc_13), which is esi+4, to the struc_13_ctor. Inside the struc_13_ctor function, it initializes the vtable pointer and other member variables.

; int __thiscall struc_13_ctor(struc_13 *this, __int16 a2)
struc_13_ctor proc near

arg_0= word ptr  4

mov     dx, [esp+arg_0]
mov     eax, ecx
xor     ecx, ecx
mov     dword ptr [eax], offset struc_13_vtable
mov     [eax+4], ecx
mov     [eax+8], ecx
mov     [eax+0Ch], dx
mov     [eax+0Eh], cx
mov     [eax+14h], ecx
mov     [eax+10h], ecx
retn    4
struc_13_ctor endp

However after returning from struc_13_ctor, it overwrites the vtable pointer with the new value, which is off_12C057C in this case.

call    struc_13_ctor
mov     dword ptr [edi], offset off_12C057C ; another vtable init ?

I have seen this kind of behaviors a lot while looking at ctor functions, but never understood why this happens.

Answer 1

I think the c++ code would look something like this:

// has vtbl struc_13_vtable
// has constructor struc_13_ctor
struct struc_13 {
    int  a,b;
    short c,d;
    int e,f;

    struc_13(short x)
       : a(0), b(0), c(x), d(0), e(0), f(0)
    { }

    virtual void someotherfn();
};

// has vtbl off_12C057C
// has inlined constructor
struct derivedmember : struc_13 {
    derivedmember() : struc_13(0x30)
    { }
    virtual void someotherfn();
};

// has vtbl off_12C0680
// has constructor sub_106C0A0
struct A {
    derivedmember  member;
    virtual void somefn();
};

Answer 2

The class of which sub_106C0A0 is a member function contains another class as a member. Assuming ecx is the class pointer, then it's ecx+4, not ecx, that gets passed to the inner constructor. So the inner class pointer is behind the vtable pointer of the outer class, which suggests something like:

class a {
    int i1, i2;
    short s1, s2;
    int i3, i4;

    a::a(int x) {
        i1=0; i2=0;
        s1=x;
        s2=0; i3=0; i4=0;
    } 
}

class b : public a {
    // whatever;
}

class outer {
    class b someelement;
    // more variables;

    outer::outer() {
        someelement=(b) new a(48);
    }
}

I'd assume the sub_106C0A0 function allocates a class instance, then casts that to another class. The cast to the other class makes the compiler replace a's vtable with b's vtable. However, i'm not 100% sure how that makes sense - if b is a real superclass of a, then casting a to b isn't safe, because the additional members aren't there; if b is a subclass of a, then there's no reason to replace the vtable when casting.

Looking at the size and entries of the vtables might help - maybe the programmer used some weird method of abstract classes and implementation classes, where the class members of one class are the abstract classes (b), but what gets instantiated by new() are the implementations (a). (That still wouldn't be a good reason to replace the implementation vtable with the abstract class vtable, however).