解读CreateClassFactory

解读CreateClassFactory

 

本篇主要包括下面几个函数：

CreateClassFactory

CCbsClassFactory::CreateInstance

CCbsClassFactory::LockServer

CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::QueryInterface

CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::AddRef

CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::Release

CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::`scalar deleting destructor'

 

50D21000 好像就是CbsCore 的起始地址。

就是刚开始的地址。

 

GUID IID_ICbsSession =
{
  1965061009u,
  9202u,
  17302u,
  {133u, 240u, 143u, 219u, 135u, 158u, 208u, 237u }
};

 

CreateClassFactory

 

//----- (50DA6F3D)--------------------------------------------------------
signed int __thiscall CreateClassFactory(_DWORD *this)
{

  v1 =this;
  v2 =0;
  v3 =operator new(8u);
  if (v3 )
  {
    v3[1] = 1;
    *v3= &CCbsClassFactory::`vftable';
  }
  else
  {
    v3 =0;
  }
  if (v3 )
  {
    *v1= v3;
  }
  else
  {
    v2 =-2147024882;
    CBSWdsLog(0x4000000, -2147024882, 1, "Failed to allocate a new CCbsClassFactory.");
  }
  return v2;
}
// 50D21000: using guessed type void*CCbsClassFactory::`vftable';

 

CCbsClassFactory::CreateInstance

 

 

//----- (10088D00)--------------------------------------------------------
int __stdcall CCbsClassFactory::CreateInstance(

CCbsClassFactory *this,

structIUnknown *a2,

const struct_GUID *a3,

void **a4)
{

  v6 =0;
  if (a4 )
  {
    *a4= 0;
    if (a2 )
    {
      v4 =-2147221232;
      CBSWdsLog(0x4000000, -2147221232, 1, "Aggregation not supported.");
    }
    else if ( IsEqualGUID(a3,&IID_IUnknown) ||IsEqualGUID(a3, &IID_ICbsSession) )
    {
      v4 =CreateSession((structCCbsPublicSession **)&v6);
      if (v4 < 0)
        CBSWdsLog(0x4000000, v4, 1, "Failed to create session.");
      else
        *a4= v6;
    }
    else
    {
      v4 =-2147467262;
      CBSWdsLog(0x4000000, -2147467262, 1, "Unknown IID requested");
    }
  }
  else
  {
    v4 =-2147024809;
    CBSWdsLog(0x4000000, -2147024809, 1, "Invalid ppvObject passed in.");
  }
  return v4;
}

 

 

//----- (100F0260)--------------------------------------------------------
__int32 __stdcall CCbsClassFactory::LockServer(

CCbsClassFactory *this,

int a2)
{
  if (a2 )
    InstanceCreated();
  else
    InstanceDestroyed();
  return 0;
}

CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::QueryInterface

 

//----- (100F0290)--------------------------------------------------------
int __stdcall CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::QueryInterface(

int a1,

const void*a2,

_DWORD *a3)
{

  v3 =0;
  if (!a3 )
  {
    v3 =-2147024809;
    CBSWdsLog(0x4000000, -2147024809, 1, "Invalid argument ppvObject");
    return v3;
  }
  *a3= 0;
  if (IsEqualGUID(&_GUID_00000001_0000_0000_c000_000000000046,a2)
    ||IsEqualGUID(&IID_IUnknown,a2)
    ||IsEqualGUID(&_GUID_00000000_0000_0000_c000_000000000046,a2)
    ||IsEqualGUID(&_GUID_00000000_0000_0000_c000_000000000046,a2)
    ||IsEqualGUID(&_GUID_00000000_0000_0000_c000_000000000046,a2)
    ||IsEqualGUID(&_GUID_00000000_0000_0000_c000_000000000046,a2) )
  {
    *a3= a1;
    v4 =*(void(__stdcall **)(int))(*(_DWORD *)a1 + 4);
    __guard_check_icall_fptr(*(_DWORD *)(*(_DWORD *)a1 + 4));
    v4(a1);
    return v3;
  }
  v6 =*(int(__thiscall **)(int, const void *, _DWORD *))(*(_DWORD *)a1 + 32);
  __guard_check_icall_fptr(*(_DWORD *)(*(_DWORD *)a1 + 32));
  return v6(a1, a2, a3);
}

CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::AddRef

 

//----- (100F0210)--------------------------------------------------------
signed __int32 __stdcall CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::AddRef(

int a1)
{

  v1 =*(void(__thiscall **)(int))(*(_DWORD *)a1 + 24);
  __guard_check_icall_fptr(*(_DWORD *)(*(_DWORD *)a1 + 24));
  v1(a1);
  return _InterlockedIncrement((volatile signed __int32 *)(a1 + 4));
}

CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::Release

 

//----- (10088C40)--------------------------------------------------------
signed __int32 __stdcall CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::Release(

void *Memory)
{

  v1 =*(void(__thiscall **)(void *))(*(_DWORD *)Memory +28);
  __guard_check_icall_fptr(*(_DWORD *)(*(_DWORD *)Memory +28));
  v1(Memory);
  result =_InterlockedDecrement((volatile signed__int32 *)Memory +1);
  if (result <= 0)
  {
    v3 =*(void*(__thiscall**)(void*, char))(*(_DWORD *)Memory +20);
    if (v3 == CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::`scalar deleting destructor' )
    {
      CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::`scalar deleting destructor'(Memory, 1);
    }
    else
    {
      __guard_check_icall_fptr(*(_DWORD *)(*(_DWORD *)Memory +20));
      v3(Memory,1);
    }
    result =0;
  }
  return result;
}

 

CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::`scalar deleting destructor'

//----- (10088CD0)--------------------------------------------------------
void *__thiscallCCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::`scalar deleting destructor'(

void *Memory,

char a2)
{

  v2 =Memory;
  *(_DWORD *)Memory =&CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::`vftable';
  if (a2 & 1)
    operator delete(Memory);
  return v2;
}
// 1000127C: using guessed type void*CCbsIUnknownImpl<IClassFactory,IUnknown,IUnknown,IUnknown,IUnknown>::`vftable';