3

I've instrumented an application using Frida.RE. I can hook the constructor of a C++ class of my interest, let's call this MyClass::MyClass().

I want to call the non-static MyClass::SomeMethod() on an object instance. To do this I need to have the address of the object instance so I can pass it to the method as the implicit 'this' argument.

Is there a way to monitor the addresses of the created instances of MyClass?

Or is there some other way to call the SomeMethod() method of an already instantiated object?

Update:

I tried to simply record the 0th argument passed to the constructor with Frida (args[0]), but I couldn't access the this pointer, only the first "real" argument (passed explicitly by the caller).

I can think of two things:

  1. Frida doesn't care about the implicit this argument, or
  2. things are messed up because of the thiscall scheme used in Windows programs (I'm experimenting on 32-bit Windows). I couldn't figure out a way to get the value of ECX with Frida though...
  • @DCoder correct – buherator Feb 15 '14 at 14:55
2

First parameter of the constructor is the memory allocated for the object. (Usually stored at r0 for ARM and thumb). So the way to monitor it is simple: instrument all constructors of the class and watch the first constructor parameter.

  • Thank you for your answer. Unfortunately it doesn't fit my problem, I'm updating my question with the details about why. – buherator Feb 20 '14 at 13:33

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.