2

I have a large c++ program and I have found a pointer to an object of interest. I want to be able to identidy that object by atleast the constructor. What are some methods I can use to identify the constructor when the object's constructor is "nowhere in sight", i.e., it's far back in the program flow?

4

I have dabbled in this a little bit in the past, and one way to find the constructor is to try and find the Virtual Function Table for this object (VTable).

Note that not all classes have virtual functions, and so not all classes have virtual tables.

Generally the pointer to the VTable is the first value in the objects memory e.g. Object_base_address+0x00

More information on vtables is here
https://stackoverflow.com/questions/3554909/what-is-vtable-in-c
and here
https://alschwalm.com/blog/static/2016/12/17/reversing-c-virtual-functions/

The other way is to explore what compilers do when they generate code for constructors by writing your own code and reverse engineering that.
This better understanding can then be applied to your larger program in your search for the specific function. It is important to note that code generation varies from compiler to compiler.
For this method you can use https://godbolt.org/ which lets you compile straight to assembly code and explore it.

If you need more information feel free to ask.

1
  • I am currently busy right now, but i will try to update with a bit more information later
    – Samson
    Jun 15 '17 at 3:39
2

I would like to expand a bit on the previous answer after I have learned some more about decompilation. There are two principle types of objects in c++ (on MS Windows, that is). Those two are objects with vtables and objects without vtables.

In objects without vtables, identifying them is definitely more tricky, but on the plus side, these are usually either very big structures that are declared at compile time, or small structures that are constructed within the scope of the function. So you can either tell the object apart by it's constructor or it's address in the memory. Or at the very least, locally constructed objects without vtables aren't too many function calls behind.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.