CCSIExternalTransformerExecutor和 CCSIExternalTransformerExecutor::Impl

CCSIExternalTransformerExecutor和 CCSIExternalTransformerExecutor::Impl

 

CCSIExternalTransformerExecutor 有 8 个字段;

CCSIExternalTransformerExecutor::Impl 有 50 个字段。

 

两者是否有关系，是父子类吗？

(571d3d7c)

(int*)vfptr-2

CCSIExternalTransformerExecutor 有 8 个字段

+0      +1       +2     +3      +4       +5     +6      +7

571d3d98 00000002 571d3d7c 00000009 006c444800000000 00000000 00000000

 

+0

CComObjectBase 的地址

CComObject<CCSIExternalTransformerExecutor>::`vftable':

572996f0 57430960573b4b20 57265040 5729f9e0 5729ff00 5729fee0

+1

 

+2

ICSIExternalTransformerExecutor 的地址

CComObject<CCSIExternalTransformerExecutor>::`vftable':

5729b520 57285f10572686e0 5729abf0 5729b340 5729bc20 57299b80

+3

 

+4

CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff的地址

+5

 

+6

 

+7

 

CSystemIsolationLayer

+0      +1     +2

571d4724 006beae0 571d42f4

+0

CCdfBinaryTableEnumerator的地址

+1

57203a54 00000001006beae0 5744d740 006b9548 006c4150 006c4170 006b9508

+2

CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff的地址

 

 

 

//----- (100C9723) --------------------------------------------------------
_DWORD *__thiscall Windows::Auto<CComObject<CCSIExternalTransformerExecutor> *>::Allocate(_DWORD *this)
{

  v1 =this;
  result =operator new((void *)0x20);
  if (result )
  {
    result[3] = 0xFFFF;
    result[1] = 0;
    result[4] = 0;
    result[5] = 0;
    result[6] = 0;
    result[7] = 0;
    *result= &CComObject<CCSIExternalTransformerExecutor>::`vftable'{for`CComObjectBase'}; // 10003D98
    result[2] = &CComObject<CCSIExternalTransformerExecutor>::`vftable'{for`ICSIExternalTransformerExecutor'};// 10003D7C
  }
  else
  {
    result =0;
  }
  *v1= result;
  return result;
}
// 10003D7C: using guessed type void*CComObject<CCSIExternalTransformerExecutor>::`vftable'{for`ICSIExternalTransformerExecutor'};
// 10003D98: using guessed type int (__thiscall*CComObject<CCSIExternalTransformerExecutor>::`vftable'{for`CComObjectBase'})(PVOID Address, char);

 

//----- (100C9766)--------------------------------------------------------
CCSIExternalTransformerExecutor::Impl *__thiscallAutoPimplPtr<CCSIExternalTransformerExecutor::Impl>::Allocate(

CCSIExternalTransformerExecutor::Impl **this)
{

  v1 =this;
  v2 =0;
  if (*this )
    RtlRaiseStatus(C00000E5);
  v1[1] = (CCSIExternalTransformerExecutor::Impl*)Windows::`anonymousnamespace'::CloseWithDelete<CCSIExternalTransformerExecutor::Impl>;
  v3 =(CCSIExternalTransformerExecutor::Impl *)RtlAllocateHeap(
         *(HANDLE *)(__readfsdword(48) + 24),
         0,
         0xC8u);
  if (v3 )
    v2 =CCSIExternalTransformerExecutor::Impl::Impl(v3);
  *v1= v2;
  return v2;
}

//----- (100C9284)--------------------------------------------------------
CCSIExternalTransformerExecutor::Impl *__thiscallCCSIExternalTransformerExecutor::Impl::Impl(CCSIExternalTransformerExecutor::Impl*this)
{

  v1 =this;
  *(_DWORD *)this =0;
  *((_DWORD *)this +1) = 0;
  *((_DWORD *)this +2) = 0;
 CTransactionContent::CTransactionContent((

    CCSIExternalTransformerExecutor::Impl *)((char*)this+ 12));
  *((_DWORD *)v1 + 24) = 0;
  *((_DWORD *)v1 + 25) = 0;
  *((_DWORD *)v1 + 26) = 0;
  *((_DWORD *)v1 + 27) = 0;
  *((_DWORD *)v1 + 28) = 0;
  *((_DWORD *)v1 + 29) = 0;
  CRegistryKey::CRegistryKey((

    CCSIExternalTransformerExecutor::Impl *)((char*)v1+ 120)); // +30
  Windows::Rtl::AutoHive::AutoHive((

    CCSIExternalTransformerExecutor::Impl *)((char*)v1+ 172)); // +43
  *((_DWORD *)v1 + 49) = 0;
  return v1;
}