0

How to properly define these so many this variables in C++ programs. Is it a structure or something else at the assembly level?

For example, this function seems to allocate heap memory.

int __thiscall heapAlloc(int this, char *Str)
{
  int v2; // esi@1
  size_t v3; // eax@2
  char *v4; // eax@2

  v2 = this;
  *(_DWORD *)(this + 4) = -1;
  *(_DWORD *)(this + 308) = -1;
  *(_DWORD *)this = 0;
  *(_DWORD *)(this + 312) = 0;
  *(_DWORD *)(this + 316) = 0;
  if ( Str )
  {
    v3 = strlen(Str);
    v4 = (char *)operator new(v3 + 1);
    *(_DWORD *)(v2 + 312) = v4;
    strcpy(v4, Str);
  }
 return v2;
}
1
  • there are five this variables because they are members of the this structure redefine you int this struct this with appropriate length and redecompile i will bet all the this+x. will turn to. this->foo etc as to why only two is used in code may be other members are used after returning from the function possibly
    – blabb
    Jun 11 '17 at 8:55
1

This is indeed an object of a relatively big class. Only a handful of the class members are initialized in the provided function. The function might be called by other initialization code, where other members are initialized.

I often define a struct big enough to hold all members I encounter of a single class, where unknown portions are either undefined or a single array labelled unknown_X. As I recognise more members the class structures become more complete and clear, as well as additional meanings are given to most members.

While doing that, you should keep in mind classes might inherit one another, so class structures might be contained as other class structures and be used independently at the same time. I often combine and merge class structures as I go and when I'm confident enough structures are indeed shared. I find that reversing initialization code is very helpful in mapping classes and their structures.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.