关于com接口调用的反汇编

只是为了测试，现在只写一个接口的自定义的两个函数

这是接口的定义

[
	object,
	uuid(C320028D-2E57-46FD-8D80-F24315B58543),
	dual,
	nonextensible,
	pointer_default(unique)
]
interface IDiction : IDispatch{
	HRESULT  justTest();
	HRESULT test_3();
};只有两个成员函数

很简单吧，只是为了测试哈，现在看看调用COM的客户端的源代码

#include
  
  
   
   
#include
   
   
    
    
using namespace std;
#import"D:\project\Dic\Debug\Dic.dll" no_namespace
int _tmain(int argc, _TCHAR* argv[])
{
	::CoInitialize(NULL);
	IDictionPtr test;
	test.CreateInstance(__uuidof(Diction));
	test->justTest();
	test->test_3();
	test.Release();
	::CoUninitialize ();
	return 0;
}

   
   
  
  

接连调用IDiction的两个接口而已，现在看看，起反汇编代码：重头戏来了

.text:00401000 ; int __cdecl wmain(int argc, wchar_t **argv)
.text:00401000 _wmain          proc near               ; CODE XREF: __tmainCRTStartup+11Dp
.text:00401000
.text:00401000 test            = _com_ptr_t<_com_IIID
  
  
   
    > ptr -10h
.text:00401000 var_C           = dword ptr -0Ch
.text:00401000 var_4           = dword ptr -4
.text:00401000 argc            = dword ptr  8
.text:00401000 argv            = dword ptr  0Ch
.text:00401000
.text:00401000                 push    ebp
.text:00401001                 mov     ebp, esp
.text:00401003                 push    0FFFFFFFFh
.text:00401005                 push    offset __ehhandler$_wmain
.text:0040100A                 mov     eax, large fs:0
.text:00401010                 push    eax
.text:00401011                 push    ecx
.text:00401012                 push    esi             ; dwClsContext
.text:00401013                 push    edi             ; pOuter
.text:00401014                 mov     eax, ___security_cookie
.text:00401019                 xor     eax, ebp
.text:0040101B                 push    eax             ; rclsid
.text:0040101C                 lea     eax, [ebp+var_C]
.text:0040101F                 mov     large fs:0, eax
.text:00401025                 push    0               ; pvReserved
.text:00401027                 call    ds:CoInitialize(x)
.text:0040102D                 mov     [ebp+test.m_pInterface], 0
.text:00401034                 lea     edi, [ebp+test]
.text:00401037                 mov     [ebp+var_4], 0
.text:0040103E                 call    _com_ptr_t<_com_IIID
   
   
    
    >::CreateInstance(_GUID const &,IUnknown *,ulong);这是调用的智能接口的CreateInstance
.text:00401043                 mov     eax, [ebp+test.m_pInterface]
.text:00401046                 test    eax, eax;检测调用是否成功，如果不成功，则转到错误处理过程
.text:00401048                 jnz     short $LN30
.text:0040104A                 push    80004003h       ; hr
.text:0040104F                 call    _com_issue_error(long)
.text:00401054 ; ---------------------------------------------------------------------------
.text:00401054
.text:00401054 $LN30:                                  ; CODE XREF: _wmain+48j
.text:00401054                 mov     ecx, [eax]
.text:00401056                 mov     edx, [ecx+1Ch];注意这个偏移量，1CH,我想这是justTest的所在，也就是说1CH是，该功能函数在接口中的偏移量
.text:00401059                 push    eax
.text:0040105A                 mov     esi, eax
.text:0040105C                 call    edx;这是调用过程
.text:0040105E                 test    eax, eax;同上检测函数执行是否成功
.text:00401060                 jns     short loc_40106E
.text:00401062                 push    offset __GUID_c320028d_2e57_46fd_8d80_f24315b58543 ; riid这是接口的GUID
.text:00401067                 push    esi             ; punk
.text:00401068                 push    eax             ; hr
.text:00401069                 call    _com_issue_errorex(long,IUnknown *,_GUID const &)
.text:0040106E ; ---------------------------------------------------------------------------
.text:0040106E
.text:0040106E loc_40106E:                             ; CODE XREF: _wmain+60j
.text:0040106E                 mov     eax, [ebp+test.m_pInterface]
.text:00401071                 test    eax, eax
.text:00401073                 jnz     short $LN31
.text:00401075                 push    80004003h       ; hr
.text:0040107A                 call    _com_issue_error(long)
.text:0040107F ; ---------------------------------------------------------------------------
.text:0040107F
.text:0040107F $LN31:                                  ; CODE XREF: _wmain+73j
.text:0040107F                 mov     ecx, [eax]
.text:00401081                 mov     edx, [ecx+20h];20是test_3的偏移量
.text:00401084                 push    eax
.text:00401085                 mov     esi, eax
.text:00401087                 call    edx;这是调用test_3功能的过程
.text:00401089                 test    eax, eax;同上检测是否成功执行
.text:0040108B                 jns     short loc_401099
.text:0040108D                 push    offset __GUID_c320028d_2e57_46fd_8d80_f24315b58543 ; riid
.text:00401092                 push    esi             ; punk
.text:00401093                 push    eax             ; hr
.text:00401094                 call    _com_issue_errorex(long,IUnknown *,_GUID const &)
.text:00401099 ; ---------------------------------------------------------------------------
.text:00401099
.text:00401099 loc_401099:                             ; CODE XREF: _wmain+8Bj
.text:00401099                 mov     eax, [ebp+test.m_pInterface]
.text:0040109C                 test    eax, eax
.text:0040109E                 jnz     short $LN32
.text:004010A0                 push    80004003h       ; hr
.text:004010A5                 call    _com_issue_error(long)
.text:004010AA ; ---------------------------------------------------------------------------
.text:004010AA
.text:004010AA $LN32:                                  ; CODE XREF: _wmain+9Ej
.text:004010AA                 mov     ecx, [eax]
.text:004010AC                 mov     edx, [ecx+8];这个就比较特殊了，经笔者测试，8是一个定值，也就是说Release的偏移量永远是8
.text:004010AF                 push    eax
.text:004010B0                 call    edx
.text:004010B2                 mov     [ebp+test.m_pInterface], 0
.text:004010B9                 call    ds:CoUninitialize()
.text:004010BF                 mov     [ebp+var_4], 0FFFFFFFFh
.text:004010C6                 mov     eax, [ebp+test.m_pInterface]
.text:004010C9                 test    eax, eax
.text:004010CB                 jz      short loc_4010D5
.text:004010CD                 mov     ecx, [eax]
.text:004010CF                 mov     edx, [ecx+8]
.text:004010D2                 push    eax
.text:004010D3                 call    edx
.text:004010D5
.text:004010D5 loc_4010D5:                             ; CODE XREF: _wmain+CBj
.text:004010D5                 xor     eax, eax
.text:004010D7                 mov     ecx, [ebp+var_C]
.text:004010DA                 mov     large fs:0, ecx
.text:004010E1                 pop     ecx
.text:004010E2                 pop     edi
.text:004010E3                 pop     esi
.text:004010E4                 mov     esp, ebp
.text:004010E6                 pop     ebp
.text:004010E7                 retn
.text:004010E7 _wmain          endp


   
   
  
  

我们看下，这几个偏移量1C,20，24，之间间隔是4，也就是说每个函数地址的间隔是4，也就是说是虚函数表，他们的接口成员都是放在同一个虚函数表当中的，这下证实了书

中的话。好了，今天就到这儿吧，虽然还是没能知道__imp_baabba什么的是怎么实现的