I've instrumented an application using Frida.RE. I can hook the constructor of a C++ class of my interest, let's call this MyClass::MyClass().

I want to call the non-static MyClass::SomeMethod() on an object instance. To do this I need to have the address of the object instance so I can pass it to the method as the implicit 'this' argument.

Is there a way to monitor the addresses of the created instances of MyClass?

Or is there some other way to call the SomeMethod() method of an already instantiated object?


I tried to simply record the 0th argument passed to the constructor with Frida (args[0]), but I couldn't access the this pointer, only the first "real" argument (passed explicitly by the caller).

I can think of two things:

  1. Frida doesn't care about the implicit this argument, or
  2. things are messed up because of the thiscall scheme used in Windows programs (I'm experimenting on 32-bit Windows). I couldn't figure out a way to get the value of ECX with Frida though...
  • @DCoder correct – buherator Feb 15 '14 at 14:55

First parameter of the constructor is the memory allocated for the object. (Usually stored at r0 for ARM and thumb). So the way to monitor it is simple: instrument all constructors of the class and watch the first constructor parameter.

| improve this answer | |
  • Thank you for your answer. Unfortunately it doesn't fit my problem, I'm updating my question with the details about why. – buherator Feb 20 '14 at 13:33

I was also struggling with this, until I realized that if the function uses a custom calling convention. args[n] assumes the default calling convention. For custom calling conventions, in this case __thiscall scheme, the pointer to this is on ecx register (accessible through this.context.ecx).

Hope this helps anyone!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.