3

I've instrumented an application using Frida.RE. I can hook the constructor of a C++ class of my interest, let's call this MyClass::MyClass().

I want to call the non-static MyClass::SomeMethod() on an object instance. To do this I need to have the address of the object instance so I can pass it to the method as the implicit 'this' argument.

Is there a way to monitor the addresses of the created instances of MyClass?

Or is there some other way to call the SomeMethod() method of an already instantiated object?

Update:

I tried to simply record the 0th argument passed to the constructor with Frida (args[0]), but I couldn't access the this pointer, only the first "real" argument (passed explicitly by the caller).

I can think of two things:

  1. Frida doesn't care about the implicit this argument, or
  2. things are messed up because of the thiscall scheme used in Windows programs (I'm experimenting on 32-bit Windows). I couldn't figure out a way to get the value of ECX with Frida though...
1
  • @DCoder correct
    – buherator
    Feb 15, 2014 at 14:55

2 Answers 2

2

First parameter of the constructor is the memory allocated for the object. (Usually stored at r0 for ARM and thumb). So the way to monitor it is simple: instrument all constructors of the class and watch the first constructor parameter.

1
  • Thank you for your answer. Unfortunately it doesn't fit my problem, I'm updating my question with the details about why.
    – buherator
    Feb 20, 2014 at 13:33
1

I was also struggling with this, until I realized that if the function uses a custom calling convention. args[n] assumes the default calling convention. For custom calling conventions, in this case __thiscall scheme, the pointer to this is on ecx register (accessible through this.context.ecx).

Hope this helps anyone!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.