1.代码
#include<iostream>
using namespace std;
class A
{
public:
virtual void fun1(){ cout<<"A::fun1"<<endl;}
virtual void fun2(){cout<<"A::fun2"<<endl;}
};
class B : public A
{
public:
virtual void fun1(){ cout<<"B::fun1"<<endl;}
virtual void fun2(){cout<<"B::fun2"<<endl;}
};
void main(){
void (A::*f1)();
void (A::*f2)();
A *p=new B;
f1 = &A::fun1;
f2 = &A::fun2;
(p->*f1)();
(p->*f2)();
printf("f1 = %p f2 = %p\n", f1, f2);
printf("B::fun1 = %p, B::fun2 = %p\n", &A::fun1, &A::fun2);
delete p;
system("pause");
}2.结果
B::fun1
B::fun2
f1 = 004010AA f2 = 004010B4
B::fun1 = 004010AA, B::fun2 = 004010B4
3.解惑
i. 如果对于为什么f = A::funx 却输出的是B::funx？
ii. 为什么A::funx = B::funx
以上两个问题可以当作是一个，看看汇编就知道了，他们将生成一个虚函数的选择函数，短小的函数负责选对应虚函数中的位置，根据对象的虚函数表而定，所以....
4.汇编
debug
0040121E . C745 F0 AA104>mov dword ptr [ebp-10], 004010AA
00401225 . C745 EC B4104>mov dword ptr [ebp-14], 004010B4
0040122C . 8BF4 mov esi, esp
0040122E . 8B4D E8 mov ecx, [ebp-18]
00401231 . FF55 F0 call [ebp-10]
00401234 . 3BF4 cmp esi, esp
00401236 . E8 A5870000 call _chkesp
0040123B . 8BF4 mov esi, esp
0040123D . 8B4D E8 mov ecx, [ebp-18]
00401240 . FF55 EC call [ebp-14]
00401243 . 3BF4 cmp esi, esp
00401245 . E8 96870000 call _chkesp
0040124A . 8B55 EC mov edx, [ebp-14]
0040124D . 52 push edx ; /<%p>
0040124E . 8B45 F0 mov eax, [ebp-10] ; |
00401251 . 50 push eax ; |<%p>
00401252 . 68 48404300 push 00434048 ; |format = "f1 = %p f2 = %p",LF,""
00401257 . E8 14820000 call printf ; \printf
0040125C . 83C4 0C add esp, 0C
0040125F . 68 B4104000 push 004010B4 ; /<%p> = Cplusplu.004010B4
00401264 . 68 AA104000 push 004010AA ; |<%p> = Cplusplu.004010AA
00401269 . 68 24404300 push 00434024 ; |format = "B::fun1 = %p, B::fun2 = %p",LF,""
0040126E . E8 FD810000 call printf ; \printf
00402300 > > \8B01 mov eax, [ecx] // 第一个虚函数
00402302 . FF20 jmp [eax]
00402304 CC int3
00402305 CC int3
00402306 CC int3
00402307 CC int3
00402308 CC int3
00402309 CC int3
0040230A CC int3
0040230B CC int3
0040230C CC int3
0040230D CC int3
0040230E CC int3
0040230F CC int3
00402310 > > 8B01 mov eax, [ecx] // 第二个虚汗数
00402312 . FF60 04 jmp [eax+4]
release
posted on 2008-03-08 18:12
margin 阅读(297)
评论(0) 编辑 收藏 引用 所属分类:
C/C++ 、
逆向工程