Delphi的Anymouse方法探秘

这段时间换工作.加之身体不太好.总是感冒和喉咙发炎.就整天躺在家里等待面试电话.刚好有了点时间能看看Delphi的一些新东西

自从Delphi2009以后增加了一种匿名方法.

通过反汇编跟踪发现是编译器利用插入接口,类,对象来实现的.

Delphi2010刚好有RTTI的增强.我们就可以还原这个接口和类.至于RTTI的用法可以参看我前面的文章.

 

说干就干,挽袖子操刀

多余的话不多说.

procedure Test(Strs : TStrings);
type
  TProc = reference to function () : TObject;
var
  p : TProc;
  R : TRttiContext;
  RT : TRttiType;
  Fs : TArray<TRttiField>;
  MS : TArray<TRttiMethod>;
  I : Integer;
  Obj : TObject;
  Interfaces : string;
begin
  Strs.Clear;
  p := function () : TObject
        begin
          //
          asm
            mov Result, eax //如果这个Anymouse方法被编译成成员方法的话,因为Delphi默认的Register调用约定,EAX中方的肯定是Self.
          end;
          //其实这句汇编代码不加应该也可以.因为固然Self在EAX中,Result也是EAX.所以写成空函数也没问题.这里这样写是为了更好读
        end;

  Obj := p();
  R := TRttiContext.Create;
  RT := R.GetType(Obj.ClassType);
  FS := RT.GetFields();
  MS := RT.GetMethods();

  Strs.Add('======================================================');
  Strs.Add(Format('Obj[%0.8x],ClassName[%s],InstanceSize[%d],UnitName[%s]',[Integer(Obj), obj.ClassName, Obj.InstanceSize, obj.UnitName]));
  Strs.Add('编译器会生成一个临时类,绑定一个临时接口的.类名规则是:Anymouse方法所在函数名+$ActRec,所以这里就是Test$ActRec');
  Strs.Add('临时接口至少有一个方法是Anymouse方法.但是通过RTTI我们未必能获取这个方法.因为尽管接口中的方法一定是Public的');
  Strs.Add('但是临时类的实现中该方法完全可能是Private或者Protected的.这样RTTI是取不到这些方法的');
  Strs.Add('======================================================');
  Strs.Add('类的形式如下:');
  for I := 0 to Obj.GetInterfaceTable()^.EntryCount - 1 do
     if I = 0 then
       Interfaces := Format('[%s]',[GUIDToString(Obj.GetInterfaceTable()^.Entries[i].IID)])
     else
       Interfaces := Interfaces + ','+ Format('[%s]',[GUIDToString(Obj.GetInterfaceTable()^.Entries[i].IID)]);
  Strs.Add('Type');
  Strs.Add(format('Class %s = class(%s,%s) //如果GUID全零,说明绑定的该接口没有GUID',[obj.ClassName, obj.ClassParent.ClassName, Interfaces]));
  for I := 0 to Length(FS) - 1 do
    Strs.Add(Format('  %s : %s;//继承自%s',[FS[i].Name, FS[i].FieldType.Name ,Fs[i].Parent.Name]));
  for I := 0 to Length(MS) - 1 do
     Strs.Add(Format('  %s;//继承自%s',[MS[i].ToString(), MS[i].Parent.Name]));
  Strs.Add('end;');

  R.Free;

end;

 

procedure TForm2.btn1Click(Sender: TObject);
begin
  Test(memo1.Lines);
end;

 

那么点击Form上的按钮以后Memo1的内容就是:

======================================================
Obj[00AEA330],ClassName[Test$ActRec],InstanceSize[20],UnitName[Unit2]
编译器会生成一个临时类,绑定一个临时接口的.类名规则是:Anymouse方法所在函数名+$ActRec,所以这里就是Test$ActRec
临时接口至少有一个方法是Anymouse方法.但是通过RTTI我们未必能获取这个方法.因为尽管接口中的方法一定是Public的
但是临时类的实现中该方法完全可能是Private或者Protected的.这样RTTI是取不到这些方法的
======================================================
类的形式如下:
Type
Class Test$ActRec = class(TInterfacedObject,[{00000000-0000-0000-0000-000000000000}]) //如果GUID全零,说明绑定的该接口没有GUID
  FRefCount : Integer;//继承自TInterfacedObject
  procedure AfterConstruction;//继承自TInterfacedObject
  procedure BeforeDestruction;//继承自TInterfacedObject
  class function NewInstance: TObject;//继承自TInterfacedObject
  constructor Create;//继承自TObject
  procedure Free;//继承自TObject
  class function InitInstance(Instance: Pointer): TObject;//继承自TObject
  procedure CleanupInstance;//继承自TObject
  function ClassType: TClass;//继承自TObject
  class function ClassName: string;//继承自TObject
  class function ClassNameIs(const Name: string): Boolean;//继承自TObject
  class function ClassParent: TClass;//继承自TObject
  class function ClassInfo: Pointer;//继承自TObject
  class function InstanceSize: Integer;//继承自TObject
  class function InheritsFrom(AClass: TClass): Boolean;//继承自TObject
  class function MethodAddress(const Name: ShortString): Pointer;//继承自TObject
  class function MethodAddress(const Name: string): Pointer;//继承自TObject
  class function MethodName(Address: Pointer): string;//继承自TObject
  function FieldAddress(const Name: ShortString): Pointer;//继承自TObject
  function FieldAddress(const Name: string): Pointer;//继承自TObject
  function GetInterface(const IID: TGUID; out Obj): Boolean;//继承自TObject
  class function GetInterfaceEntry(const IID: TGUID): PInterfaceEntry;//继承自TObject
  class function GetInterfaceTable: PInterfaceTable;//继承自TObject
  class function UnitName: string;//继承自TObject
  function Equals(Obj: TObject): Boolean;//继承自TObject
  function GetHashCode: Integer;//继承自TObject
  function ToString: string;//继承自TObject
  function SafeCallException(ExceptObject: TObject; ExceptAddr: Pointer): HRESULT;//继承自TObject
  procedure AfterConstruction;//继承自TObject
  procedure BeforeDestruction;//继承自TObject
  procedure Dispatch(var Message);//继承自TObject
  procedure DefaultHandler(var Message);//继承自TObject
  class function NewInstance: TObject;//继承自TObject
  procedure FreeInstance;//继承自TObject
  class destructor Destroy;//继承自TObject
end;

我们再看如果有多个Anymouse方法的话是怎样处理的.

procedure Test(Strs : TStrings);
type
  TProc = reference to function () : TObject;
var
  p : TProc;
  R : TRttiContext;
  RT : TRttiType;
  Fs : TArray<TRttiField>;
  MS : TArray<TRttiMethod>;
  I : Integer;
  Obj : TObject;
  Interfaces : string;
begin
  Strs.Clear;
  p := function () : TObject
        begin
          //
          asm
            mov Result, eax //如果这个Anymouse方法被编译成成员方法的话,因为Delphi默认的Register调用约定,EAX中方的肯定是Self.
          end;
          //其实这句汇编代码不加应该也可以.因为固然Self在EAX中,Result也是EAX.所以写成空函数也没问题.这里这样写是为了更好读
        end;

  Obj := p();
  R := TRttiContext.Create;
  RT := R.GetType(Obj.ClassType);
  FS := RT.GetFields();
  MS := RT.GetMethods();

  Strs.Add('======================================================');
  Strs.Add(Format('Obj[%0.8x],ClassName[%s],InstanceSize[%d],UnitName[%s]',[Integer(Obj), obj.ClassName, Obj.InstanceSize, obj.UnitName]));
  Strs.Add('编译器会生成一个临时类,绑定一个临时接口的.类名规则是:Anymouse方法所在函数名+$ActRec,所以这里就是Test$ActRec');
  Strs.Add('临时接口至少有一个方法是Anymouse方法.但是通过RTTI我们未必能获取这个方法.因为尽管接口中的方法一定是Public的');
  Strs.Add('但是临时类的实现中该方法完全可能是Private或者Protected的.这样RTTI是取不到这些方法的');
  Strs.Add('======================================================');
  Strs.Add('类的形式如下:');
  for I := 0 to Obj.GetInterfaceTable()^.EntryCount - 1 do
     if I = 0 then
       Interfaces := Format('[%s]',[GUIDToString(Obj.GetInterfaceTable()^.Entries[i].IID)])
     else
       Interfaces := Interfaces + ','+ Format('[%s]',[GUIDToString(Obj.GetInterfaceTable()^.Entries[i].IID)]);
  Strs.Add('Type');
  Strs.Add(format('Class %s = class(%s,%s) //如果GUID全零,说明绑定的该接口没有GUID',[obj.ClassName, obj.ClassParent.ClassName, Interfaces]));
  for I := 0 to Length(FS) - 1 do
    Strs.Add(Format('  %s : %s;//继承自%s',[FS[i].Name, FS[i].FieldType.Name ,Fs[i].Parent.Name]));
  for I := 0 to Length(MS) - 1 do
     Strs.Add(Format('  %s;//继承自%s',[MS[i].ToString(), MS[i].Parent.Name]));
  Strs.Add('end;');

  R.Free;

  //===========================================================================
  p := function () : TObject
        begin

          asm
            mov Result, eax
          end;
          GetTickcount(); //稍加变化
        end;

  Obj := p();
  R := TRttiContext.Create;
  RT := R.GetType(Obj.ClassType);
  FS := RT.GetFields();
  MS := RT.GetMethods();

  Strs.Add('======================================================');
  Strs.Add(Format('Obj[%0.8x],ClassName[%s],InstanceSize[%d],UnitName[%s]',[Integer(Obj), obj.ClassName, Obj.InstanceSize, obj.UnitName]));
  Strs.Add('编译器会生成一个临时类,绑定一个临时接口的.类名规则是:Anymouse方法所在函数名+$ActRec,所以这里就是Test$ActRec');
  Strs.Add('临时接口至少有一个方法是Anymouse方法.但是通过RTTI我们未必能获取这个方法.因为尽管接口中的方法一定是Public的');
  Strs.Add('但是临时类的实现中该方法完全可能是Private或者Protected的.这样RTTI是取不到这些方法的');
  Strs.Add('======================================================');
  Strs.Add('类的形式如下:');
  for I := 0 to Obj.GetInterfaceTable()^.EntryCount - 1 do
     if I = 0 then
       Interfaces := Format('[%s]',[GUIDToString(Obj.GetInterfaceTable()^.Entries[i].IID)])
     else
       Interfaces := Interfaces + ','+ Format('[%s]',[GUIDToString(Obj.GetInterfaceTable()^.Entries[i].IID)]);
  Strs.Add('Type');
  Strs.Add(format('Class %s = class(%s,%s) //如果GUID全零,说明绑定的该接口没有GUID',[obj.ClassName, obj.ClassParent.ClassName, Interfaces]));
  for I := 0 to Length(FS) - 1 do
    Strs.Add(Format('  %s : %s;//继承自%s',[FS[i].Name, FS[i].FieldType.Name ,Fs[i].Parent.Name]));
  for I := 0 to Length(MS) - 1 do
     Strs.Add(Format('  %s;//继承自%s',[MS[i].ToString(), MS[i].Parent.Name]));
  Strs.Add('end;');

  R.Free;
  Strs.Add('以上重复两次,发现对象地址都是一样的.说明临时类和临时对象都只创建一份.');
  Strs.Add('但是临时类绑定了两个接口.说明每个Anymouse方法都绑定到一个独立的Interface上.');

end;

把Anymouse方法和对象解析部分在复制一遍.

执行后memo1的内容就是:

======================================================
Obj[00AE2960],ClassName[Test$ActRec],InstanceSize[24],UnitName[Unit2]
编译器会生成一个临时类,绑定一个临时接口的.类名规则是:Anymouse方法所在函数名+$ActRec,所以这里就是Test$ActRec
临时接口至少有一个方法是Anymouse方法.但是通过RTTI我们未必能获取这个方法.因为尽管接口中的方法一定是Public的
但是临时类的实现中该方法完全可能是Private或者Protected的.这样RTTI是取不到这些方法的
======================================================
类的形式如下:
Type
Class Test$ActRec = class(TInterfacedObject,[{00000000-0000-0000-0000-000000000000}],[{00000000-0000-0000-0000-000000000000}]) //如果GUID全零,说明绑定的该接口没有GUID
  FRefCount : Integer;//继承自TInterfacedObject
  procedure AfterConstruction;//继承自TInterfacedObject
  procedure BeforeDestruction;//继承自TInterfacedObject
  class function NewInstance: TObject;//继承自TInterfacedObject
  constructor Create;//继承自TObject
  procedure Free;//继承自TObject
  class function InitInstance(Instance: Pointer): TObject;//继承自TObject
  procedure CleanupInstance;//继承自TObject
  function ClassType: TClass;//继承自TObject
  class function ClassName: string;//继承自TObject
  class function ClassNameIs(const Name: string): Boolean;//继承自TObject
  class function ClassParent: TClass;//继承自TObject
  class function ClassInfo: Pointer;//继承自TObject
  class function InstanceSize: Integer;//继承自TObject
  class function InheritsFrom(AClass: TClass): Boolean;//继承自TObject
  class function MethodAddress(const Name: ShortString): Pointer;//继承自TObject
  class function MethodAddress(const Name: string): Pointer;//继承自TObject
  class function MethodName(Address: Pointer): string;//继承自TObject
  function FieldAddress(const Name: ShortString): Pointer;//继承自TObject
  function FieldAddress(const Name: string): Pointer;//继承自TObject
  function GetInterface(const IID: TGUID; out Obj): Boolean;//继承自TObject
  class function GetInterfaceEntry(const IID: TGUID): PInterfaceEntry;//继承自TObject
  class function GetInterfaceTable: PInterfaceTable;//继承自TObject
  class function UnitName: string;//继承自TObject
  function Equals(Obj: TObject): Boolean;//继承自TObject
  function GetHashCode: Integer;//继承自TObject
  function ToString: string;//继承自TObject
  function SafeCallException(ExceptObject: TObject; ExceptAddr: Pointer): HRESULT;//继承自TObject
  procedure AfterConstruction;//继承自TObject
  procedure BeforeDestruction;//继承自TObject
  procedure Dispatch(var Message);//继承自TObject
  procedure DefaultHandler(var Message);//继承自TObject
  class function NewInstance: TObject;//继承自TObject
  procedure FreeInstance;//继承自TObject
  class destructor Destroy;//继承自TObject
end;
======================================================
Obj[00AE2960],ClassName[Test$ActRec],InstanceSize[24],UnitName[Unit2]
编译器会生成一个临时类,绑定一个临时接口的.类名规则是:Anymouse方法所在函数名+$ActRec,所以这里就是Test$ActRec
临时接口至少有一个方法是Anymouse方法.但是通过RTTI我们未必能获取这个方法.因为尽管接口中的方法一定是Public的
但是临时类的实现中该方法完全可能是Private或者Protected的.这样RTTI是取不到这些方法的
======================================================
类的形式如下:
Type
Class Test$ActRec = class(TInterfacedObject,[{00000000-0000-0000-0000-000000000000}],[{00000000-0000-0000-0000-000000000000}]) //如果GUID全零,说明绑定的该接口没有GUID
  FRefCount : Integer;//继承自TInterfacedObject
  procedure AfterConstruction;//继承自TInterfacedObject
  procedure BeforeDestruction;//继承自TInterfacedObject
  class function NewInstance: TObject;//继承自TInterfacedObject
  constructor Create;//继承自TObject
  procedure Free;//继承自TObject
  class function InitInstance(Instance: Pointer): TObject;//继承自TObject
  procedure CleanupInstance;//继承自TObject
  function ClassType: TClass;//继承自TObject
  class function ClassName: string;//继承自TObject
  class function ClassNameIs(const Name: string): Boolean;//继承自TObject
  class function ClassParent: TClass;//继承自TObject
  class function ClassInfo: Pointer;//继承自TObject
  class function InstanceSize: Integer;//继承自TObject
  class function InheritsFrom(AClass: TClass): Boolean;//继承自TObject
  class function MethodAddress(const Name: ShortString): Pointer;//继承自TObject
  class function MethodAddress(const Name: string): Pointer;//继承自TObject
  class function MethodName(Address: Pointer): string;//继承自TObject
  function FieldAddress(const Name: ShortString): Pointer;//继承自TObject
  function FieldAddress(const Name: string): Pointer;//继承自TObject
  function GetInterface(const IID: TGUID; out Obj): Boolean;//继承自TObject
  class function GetInterfaceEntry(const IID: TGUID): PInterfaceEntry;//继承自TObject
  class function GetInterfaceTable: PInterfaceTable;//继承自TObject
  class function UnitName: string;//继承自TObject
  function Equals(Obj: TObject): Boolean;//继承自TObject
  function GetHashCode: Integer;//继承自TObject
  function ToString: string;//继承自TObject
  function SafeCallException(ExceptObject: TObject; ExceptAddr: Pointer): HRESULT;//继承自TObject
  procedure AfterConstruction;//继承自TObject
  procedure BeforeDestruction;//继承自TObject
  procedure Dispatch(var Message);//继承自TObject
  procedure DefaultHandler(var Message);//继承自TObject
  class function NewInstance: TObject;//继承自TObject
  procedure FreeInstance;//继承自TObject
  class destructor Destroy;//继承自TObject
end;
以上重复两次,发现对象地址都是一样的.说明临时类和临时对象都只创建一份.
但是临时类绑定了两个接口.说明每个Anymouse方法都绑定到一个独立的Interface上.

 

 

别的也不多解释了.自己看吧