C++多重继承汇编分析

class CSofa{

public:

CSofa(){

m_nColor = 2;

}

virtual ~CSofa(){

printf("virtual ~CSofa()\r\n");

}

virtual int GetColor(){

return m_nColor;

}

virtual void SitDown(){

printf("CSofa::Sit Down\r\n");

}

protected:

int m_nColor;

};

class CBed{

public:

CBed(){

m_nLength = 4;

m_nWidth = 5;

}

virtual ~CBed(){

printf("virtual ~CBed()\r\n");

}

virtual int GetArea(){

return m_nLength*m_nWidth;

}

virtual void Sleep(){

printf("go to Sleep\r\n");

}

protected:

int m_nLength;

int m_nWidth;

};

class CSofaBed: public CSofa,public CBed{

public:

CSofaBed(){

m_nHeight = 6;

}

virtual ~CSofaBed(){

printf("virtual ~CSofaBed()\r\n");

}

virtual void SitDown(){

printf("CSofaBed::Sit Down\r\n");

}

virtual void Sleep(){

printf("CSofaBed::go to Sleep\r\n");

}

virtual int GetHeight(){

return m_nHeight;

}

protected:

int m_nHeight;

};

int main(int argc, char* argv[])

{

CSofaBed SofaBed;

return 0;

}

多重继承类CSofaBed在内存中的布局

0042501C 50 10 40 00 jmp CSofaBed::`vector deleting destructor' (00401790)

00425020 32 10 40 00 jmp CBed::GetArea (00401410)

00425024 19 10 40 00 jmp CSofaBed::Sleep (00401690)

00425028 00 00 00 00

0042502C 0F 10 40 00 jmp CSofaBed::`scalar deleting destructor' (00401720)

00425030 1E 10 40 00 jmp CSofa::GetColor (004012b0)

00425034 05 10 40 00 jmp CSofaBed::SitDown (00401640)

00425038 3C 10 40 00 jmp CSofaBed::GetHeight (004016e0)

0042503C 00 00 00 00

CSofa类中内存中的布局

00425040 23 10 40 00 jmp CSofa::`scalar deleting destructor' (00401340)

00425044 1E 10 40 00 jmp CSofa::GetColor (004012b0)

00425048 14 10 40 00 jmp CSofa::SitDown (004012f0)

0042504C 00 00 00 00

CBed类在内存中的布局

00425080 5A 10 40 00 jmp CBed::`scalar deleting destructor' (004014a0)

00425084 32 10 40 00 jmp CBed::GetArea (00401410)

00425088 2D 10 40 00 jmp CBed::Sleep (00401450)

0042508C 00 00 00 00

SofaBed类对象在内存中的布局

- &SofaBed
0x0012ff30

- CSofa
{...}

+ __vfptr
0x0042502c const CSofaBed::`vftable'{for `CSofa'}

m_nColor
0x00000002

- CBed
{...}

+ __vfptr
0x0042501c const CSofaBed::`vftable'{for `CBed'}

m_nLength
0x00000004

m_nWidth
0x00000005

m_nHeight
0x00000006

sizeof(SofaBed)0x00000018

0012FF30 2C 50 42 00

0012FF34 02 00 00 00

0012FF38 1C 50 42 00

0012FF3C 04 00 00 00

0012FF40 05 00 00 00

0012FF44 06 00 00 00

CSofaBed类的构造函数汇编：

55: class CSofaBed: public CSofa,public CBed{

56: public:

57: CSofaBed(){

00401140 push ebp

00401141 mov ebp,esp

00401143 push 0FFh

00401145 push offset __ehhandler$??0CSofaBed@@QAE@XZ (00413919)

0040114A mov eax,fs:[00000000]

00401150 push eax

00401151 mov dword ptr fs:[0],esp

00401158 sub esp,44h

0040115B push ebx

0040115C push esi

0040115D push edi

0040115E push ecx

0040115F lea edi,[ebp-50h]

00401162 mov ecx,11h

00401167 mov eax,0CCCCCCCCh

0040116C rep stos dword ptr [edi]

0040116E pop ecx

0040116F mov dword ptr [ebp-10h],ecx

00401172 mov ecx,dword ptr [ebp-10h]

00401175 call @ILT+70(CSofa::CSofa) (0040104b) ; 在地址[b]0012FF30处写入00425040[/b]

0040117A mov dword ptr [ebp-4],0

00401181 mov ecx,dword ptr [ebp-10h]

00401184 add ecx,8

00401187 call @ILT+95(CBed::CBed) (00401064) [b] ; 在地址0012FF38处写入00425080[/b]

0040118C mov eax,dword ptr [ebp-10h]

0040118F mov dword ptr [eax],offset CSofaBed::`vftable' (0042502c); 在地址0012FF30处写入0042502c

00401195 mov ecx,dword ptr [ebp-10h]

00401198 mov dword ptr [ecx+8],offset CSofaBed::`vftable' (0042501c)[b]; 在地址0012FF38处写入0042501C[/b]

58: m_nHeight = 6;

0040119F mov edx,dword ptr [ebp-10h]

004011A2 mov dword ptr [edx+14h],6

59: }

004011A9 mov dword ptr [ebp-4],0FFFFFFFFh

004011B0 mov eax,dword ptr [ebp-10h]

004011B3 mov ecx,dword ptr [ebp-0Ch]

004011B6 mov dword ptr fs:[0],ecx

004011BD pop edi

004011BE pop esi

004011BF pop ebx

004011C0 add esp,50h

004011C3 cmp ebp,esp

004011C5 call __chkesp (004017a0)

004011CA mov esp,ebp

004011CC pop ebp

004011CD ret

SofaBed类对象在内存中的布局

0012FF30 2C 50 42 00

0012FF34 02 00 00 00

0012FF38 1C 50 42 00

0012FF3C 04 00 00 00

0012FF40 05 00 00 00

0012FF44 06 00 00 00

CSofaBed对象的析构函数

61: virtual ~CSofaBed(){

00401570 push ebp

00401571 mov ebp,esp

00401573 push 0FFh

00401575 push offset __ehhandler$??1CSofaBed@@UAE@XZ (00413939)

0040157A mov eax,fs:[00000000]

00401580 push eax

00401581 mov dword ptr fs:[0],esp

00401588 sub esp,48h

0040158B push ebx

0040158C push esi

0040158D push edi

0040158E push ecx

0040158F lea edi,[ebp-54h]

00401592 mov ecx,12h

00401597 mov eax,0CCCCCCCCh

0040159C rep stos dword ptr [edi]

0040159E pop ecx

0040159F mov dword ptr [ebp-10h],ecx

004015A2 mov eax,dword ptr [ebp-10h]

004015A5 mov dword ptr [eax],offset CSofaBed::`vftable' (0042502c) [b]; 在地址0012FF30处写入0042502c[/b]

004015AB mov ecx,dword ptr [ebp-10h]

004015AE mov dword ptr [ecx+8],offset CSofaBed::`vftable' (0042501c) [b]; 在地址0012FF38处写入0042501C[/b]

004015B5 mov dword ptr [ebp-4],0

62: printf("virtual ~CSofaBed()\r\n");

004015BC push offset string "virtual ~CSofaBed()\r\n" (004250b8)

004015C1 call printf (00401cb0)

004015C6 add esp,4

63: }

004015C9 cmp dword ptr [ebp-10h],0

004015CD je CSofaBed::~CSofaBed+6Ah (004015da)

004015CF mov edx,dword ptr [ebp-10h]

004015D2 add edx,8

004015D5 mov dword ptr [ebp-14h],edx

004015D8 jmp CSofaBed::~CSofaBed+71h (004015e1)

004015DA mov dword ptr [ebp-14h],0

004015E1 mov ecx,dword ptr [ebp-14h]

004015E4 call @ILT+50(CBed::~CBed) (00401037) [b]; 在地址[b]0012FF38处写入00425080[/b][/b]

004015E9 mov dword ptr [ebp-4],0FFFFFFFFh

004015F0 mov ecx,dword ptr [ebp-10h]

004015F3 call @ILT+90(CSofa::~CSofa) (0040105f) ; 在地址[b]0012FF30处写入00425040[/b]

004015F8 mov ecx,dword ptr [ebp-0Ch]

004015FB mov dword ptr fs:[0],ecx

00401602 pop edi

00401603 pop esi

00401604 pop ebx

00401605 add esp,54h

00401608 cmp ebp,esp

0040160A call __chkesp (004017a0)

0040160F mov esp,ebp

00401611 pop ebp

00401612 ret