创建实例

创建实例

创建实例，CreateInstance 完成了所有构件的装配工作。当然，还有一个更高层的函数，CRtlOneShotTypeDescriptionInit，即100F2350，不过，在那个函数中已经看不到任何有用的内容，只是对这个函数进行了进一步的封装。

//----- (100F2202)--------------------------------------------------------
int __thiscall CRtlObjectTypeDescription<CDirectory>::

CreateInstance<CDirectory_IRtlDirectoryTearoff,CreateFileSource,IRtlDirectory>(volatilesigned __int32 *this,

// a2 用于 CDirectory 初始化

const structCreateFileSource *a2,

_DWORD *a3

)
{

  v3 =this;
  v15 =this;
  v21 =C00000E5;

  v4 = CRtlObjectTypeDescription<CDirectory>::Initialize(this);

  v5 = 0;
  v16 =0;
// 为CDirectory 对象分配了 13 个字段

  v6 = (CDirectory*)operatornew((void *)0x34);

// 构造函数 100F337D
// 就是 CDirectory 对象的地址

  v5 = CDirectory::CDirectory(v6);

// 初始化，就是用 CreateXXXSource 作为第一个参数，创建接口，见101156E6

// 因此，创建源就是虚函数地址对象。

// 在这一步还要进行基类 CSystemObject 的初始化

// 对象的初始化，完成创建接口IRtlFileSystemProvider 和 IRtlObjectProvider，从创// 建源中复制路径，并保证路径是以 \ 结尾，没有则加上。

  v4 = CDirectory::Initialize( (CDirectory *)v5,  a2);

// 把 CDirectory对象的地址放到 +2 处

  *(_DWORD *)(v5 + 8) = v5;

 

// 把 CRtlObjectTypeDescription的值放到 +3 处，就是 2

  *(_DWORD *)(v5 + 12) = v3;

// 创建 IRtlDirectoryTearoff 对象

//  有三个字段

  Auto<CRtlTearoffObject<CDirectory_IRtlDirectoryTearoff> *>::Allocate(&v16)
  v10 =v16;

 

//把 CDirectory对象的地址放到 +1 处
  *(_DWORD *)(v16 + 4) = v5;

// 这一步是干什么，是释放，还是增加计数？
  v11 =*(void(__thiscall **)(int))(*(_DWORD *)v5 + 4);
  __guard_check_icall_fptr(*(_DWORD *)(*(_DWORD *)v5 + 4));
  v11(v5);

// 把 IRtlDirectory Tearoff 对象 +2 的地址返回

  *a3 =v10 + 8;
  CBaseFrame<

CVoidRaiseFrame>::SetCanonicalSuccess(&v21);
  return v21;
}

 

 

//----- (100F2350)--------------------------------------------------------
int __stdcallCRtlOneShotTypeDescriptionInit<CDirectory>::CreateInstance<

CDirectory_IRtlDirectoryTearoff,CreateFileSource,IRtlDirectory>(

const struct CreateFileSource *a1,

volatile signed __int32 *a2)
{

  result =CRtlOneShotTypeDescriptionInit<CDirectory>::Initialize(a2);
  v3 =(volatile signed __int32*)CRtlOneShotTypeDescriptionInit<CDirectory>::TypeDescription();
  result =CRtlObjectTypeDescription<CDirectory>::CreateInstance

<CDirectory_IRtlDirectoryTearoff,CreateFileSource,IRtlDirectory>(
               v3,
               a1,
               a2);
  return result;
}

0056be78 cccccccc c6d729b1

 

+1 是 CDirectory 对象

+2 的值有问题。那么，是否要有先决条件，初始化 IRtlDirectory::`vftable' 虚函数地址。

因此，直接调用

 

创建IRtlDirectory Tearoff 对象

//----- (100F386D)--------------------------------------------------------
_DWORD *__thiscall Auto<CRtlTearoffObject<CDirectory_IRtlDirectoryTearoff> *>::Allocate(_DWORD *this)
{

  v1 =this;
  result =RtlAllocateHeap(*(HANDLE *)(__readfsdword(48) + 24), 0, 0xCu);

// 10004724: int (__thiscall *CRtlTearoffObject<CCdfGenericTableEnumeratorTearoff<CCdfDefIdTableEnumerator>>::`vftable'{for`CRtlTearoffBase<CCdfDefIdTableEnumerator>'})(PVOID Address, char);
    *result= &CRtlTearoffObject<

CCdfGenericTableEnumeratorTearoff<CCdfDefIdTableEnumerator>>

::`vftable'{for`CRtlTearoffBase<CCdfDefIdTableEnumerator>'};

// 100044FC: void *IRtlDirectory::`vftable';
    result[2] = &IRtlDirectory::`vftable';

// 100044B0: int(*CRtlTearoffObject<CDirectory_IRtlDirectoryTearoff>::`vftable'{for`IRtlDirectory'})();
    result[2] = &CRtlTearoffObject<CDirectory_IRtlDirectoryTearoff>

::`vftable'{for `IRtlDirectory'};

  *v1= result;
  return result;
}

//----- (100FCE80)--------------------------------------------------------
int__thiscall CRtlTearoffObject<CDirectory_IRtlDirectoryTearoff>

::Release(_DWORD *this)
{
  return CRtlObjectTypeDescription<CDirectory>

::ReleaseTearoff<CRtlInnerObjectTearoffImpl<CDirectory>>(
           *(_DWORD **)(*(this -1) + 12),
           (_DWORD**)this- 2,
           (_DWORD**)*(this- 1));
}

 

//----- (10113B91)--------------------------------------------------------
signed int__stdcall CRtlObjectTypeDescription<CDirectory>

::CreateTearoff<CDirectory_IRtlDirectoryTearoff,IRtlObject>(

int a1,

int *a2)
{

  v2 =0;
  v12 =C00000E5;
  v7 =0;
  Auto<CRtlTearoffObject<CDirectory_IRtlDirectoryTearoff>*>::Allocate(&v7)
 
    v4 =v7;
    *(_DWORD *)(v7 + 4) = a1;
    v5 =*(void(__thiscall **)(int))(*(_DWORD *)a1 + 4);
    __guard_check_icall_fptr(v5);
    v5(a1);
    v7 =0;
    if (v4 )
      v2 =v4 + 8;
    *a2= v2;
    CBaseFrame<CVoidRaiseFrame>::SetCanonicalSuccess(&v12);
    Auto<CRtlTearoffObject<CRtlInnerObjectTearoffImpl<CUserProfile>>*>::~Auto<CRtlTearoffObject<CRtlInnerObjectTearoffImpl<CUserProfile>>*>(&v7);
    v3 =v12;

  returnv3;
}