This is something that I found in a lot of constructors that have to do with classes that inherit from other classes. I have a vague idea as to why it's done, but I'd rather have it confirmed before having to re-visit all of my classes.
Say I have a constructor with a known signature e.g.
CPalette(). The compiler turn this into a
CPalette * __thiscall CPalette::CPalette(CPalette* this), with
this being in ecx. Hence, no values need to be retrieved from the stack. However, when the constructor is called, it looks something like this:
// with allocated memory in eax PUSH 0x01 MOV ecx, eax CALL CPalette::CPalette
Inside the constructor, this value is then used in a test:
// start of constructor PUSH -0x01 PUSH label_1 MOV eax, fs:[0x00] // question for another day PUSH eax MOV dword ptr fs:[0x00], esp SUB esp ,0x8 MOV eax, dword ptr [esp + 18] // Ghidra: ... [esp + Stack[0x04]] PUSH esi MOV esi, ecx PUSH edi TEST eax, eax MOV dword ptr [esp + 0x08], esi // Ghidra: ... [esp + local_14] MOV dword ptr [esp + 0x18], 0x00 // Ghidra: ... [esp + local_4] JZ label_2
I'm also a bit confused about Ghidra's auto-analysis, which I've attached to the end of the respective lines. The decompilation uses the name
in_stack_00000004 for the
Why do we push a 1 on the stack and what is the test doing?
My best guess is that this is a way to know if the constructor is called directly or by a child class constructor, since I've seen some
PUSH 0x00s before constructor calls inside other constructors. If this is the case, why is this done?
This is from a 32 bit windows DLL.