 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Demolish
Cheater
![]() Reputation: 0
Joined: 27 Dec 2010
Posts: 32
|
 Posted: Thu Apr 24, 2014 3:53 am Post subject: Class constructor? |
 |
|
Hey I was trying to find function that creates objects on the map, and I have been always left with something like this:
| Code: | | int __userpurge sub_4DFEB2<eax>(int a1<ecx>, double a2<st0>, int *a3) |
Is it an object constructor convention? How does it work(what arguments contains)? And how to easily find constructors and destructors?
|
|
| Back to top |
|
 |
atom0s
Moderator
 Reputation: 205
Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1
|
| Posted: Thu Apr 24, 2014 12:04 pm Post subject: |
|
|
Constructors compiled down will rely on the compiler used and settings used.
For example, with Visual Studio 2013, with full optimizing, a class constructor looks like this:
| Code: | 6F0437E0 >/$ 55 PUSH EBP
6F0437E1 |. 8BEC MOV EBP,ESP
6F0437E3 |. 6A FF PUSH -0x1
6F0437E5 |. 68 DC57046F PUSH ItemTool.6F0457DC
6F0437EA |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
6F0437F0 |. 50 PUSH EAX
6F0437F1 |. 51 PUSH ECX
6F0437F2 |. 56 PUSH ESI
6F0437F3 |. A1 0080046F MOV EAX,DWORD PTR DS:[__security_cookie]
6F0437F8 |. 33C5 XOR EAX,EBP
6F0437FA |. 50 PUSH EAX
6F0437FB |. 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-0xC]
6F0437FE |. 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
6F043804 |. 6A 58 PUSH 0x58
6F043806 |. FF15 5C60046F CALL DWORD PTR DS:[<&MSVCR120.??2@YAPAXI@Z>] ; msvcr120.??2@YAPAXI@Z
6F04380C |. 8BF0 MOV ESI,EAX
6F04380E |. 83C4 04 ADD ESP,0x4
6F043811 |. 8975 F0 MOV DWORD PTR SS:[EBP-0x10],ESI
6F043814 |. C745 FC 000000>MOV DWORD PTR SS:[EBP-0x4],0x0
6F04381B |. 85F6 TEST ESI,ESI
6F04381D |. 74 2D JE SHORT ItemTool.6F04384C
6F04381F |. 6A 58 PUSH 0x58 ; /n = 58 (88.)
6F043821 |. 6A 00 PUSH 0x0 ; |c = 00
6F043823 |. 56 PUSH ESI ; |s
6F043824 |. E8 9B1A0000 CALL ItemTool._memset ; \_memset
6F043829 |. 83C4 0C ADD ESP,0xC
6F04382C |. 8BCE MOV ECX,ESI
6F04382E |. E8 AD150000 CALL ItemTool.ItemTools::ItemTools
6F043833 |. C745 FC FFFFFF>MOV DWORD PTR SS:[EBP-0x4],-0x1
6F04383A |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-0xC]
6F04383D |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
6F043844 |. 59 POP ECX
6F043845 |. 5E POP ESI
6F043846 |. 8BE5 MOV ESP,EBP
6F043848 |. 5D POP EBP
6F043849 |. C2 0400 RETN 0x4
6F04384C |> C745 FC FFFFFF>MOV DWORD PTR SS:[EBP-0x4],-0x1
6F043853 |. 33C0 XOR EAX,EAX
6F043855 |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-0xC]
6F043858 |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
6F04385F |. 59 POP ECX
6F043860 |. 5E POP ESI
6F043861 |. 8BE5 MOV ESP,EBP
6F043863 |. 5D POP EBP
6F043864 \. C2 0400 RETN 0x4 |
In IDA (HexRays) looks like:
| Code: | IPlugin *__stdcall CreatePlugin(char *pszReserved)
{
void *v1; // eax@1
ItemTools *v2; // esi@1
IPlugin *result; // eax@2
int v4; // [sp+Ch] [bp-4h]@1
v1 = (void *)operator new(88);
v2 = (ItemTools *)v1;
v4 = 0;
if ( v1 )
{
memset(v1, 0, 0x58u);
ItemTools__ItemTools(v2);
v4 = -1;
}
else
{
result = 0;
}
return result;
} |
_________________
- Retired. |
|
| Back to top |
|
|
Demolish
Cheater
![]() Reputation: 0
Joined: 27 Dec 2010
Posts: 32
|
| Posted: Sat Apr 26, 2014 5:05 pm Post subject: |
|
|
Hmmm, looks interesting  I always tried to search for constructor by Finding what writes to last address of object list that is 0. Then I was trying to breakpoint there and search in stack what functions were called. I don't exactly know how constructors look in memory, so I really don't know what I am looking for. But still if you have more information about it, it will be nice if you share. Anyway I think I'll code some test apps with classes to see how it looks from inside. Thanks for nice answer 
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
