Android SO逆向-C++虚函数表解析

最新推荐文章于 2023-01-14 07:10:38 发布

jltxgcy

最新推荐文章于 2023-01-14 07:10:38 发布

阅读量1.8k

点赞数

分类专栏： Android Security

本文链接：https://blog.csdn.net/jltxgcy/article/details/54344986

版权

本文探讨了Android中C++的虚函数表，包括一般继承（无/有虚函数覆盖）和多重继承（无/有虚函数覆盖）的情况。重点讲解了虚函数表的结构，指出只有虚函数会出现在表中，子类会覆盖并替换父类的相应虚方法。

摘要由CSDN通过智能技术生成

0x00 一般继承（无虚函数覆盖）

class Base {

public:
	Base() { ALOGD("Base ..."); }
	virtual void f() { ALOGD("Base::f"); }
    void g() { ALOGD("Base::g"); }
	virtual void h() { ALOGD("Base::h"); }

	virtual ~Base() { ALOGD("~Base ...");  }

};

class Derived : public Base {

public:
	Derived() : Base()
	{ ALOGD("Derived ...");}
	virtual void f1() { ALOGD("Derived::f"); }
	virtual void g1() { ALOGD("Derived::g"); }
	virtual void h1() { ALOGD("Derived::h"); }

	virtual ~Derived()
	{ ALOGD("~Derived ...");  }
};

Base* base;
	base = new Derived();
	delete base;

虚函数表如下图：

0x01 一般继承（有虚函数覆盖）

class Base {

public:
	Base() { ALOGD("Base ..."); }
	virtual void f() { ALOGD("Base::f"); }
	virtual void g() { ALOGD("Base::g"); }
	virtual void h() { ALOGD("Base::h"); }

	virtual ~Base() { ALOGD("~Base ...");  }

};

class Derived : public Base {

public:
	Derived() : Base()
	{ ALOGD("Derived ...");}
	virtual void f() { ALOGD("Derived::f"); }
	virtual void g1() { ALOGD("Derived::g"); }
	virtual void h1() { ALOGD("Derived::h"); }

	virtual ~Derived()
	{ ALOGD("~Derived ...");  }
};

Base* base;
	base = new Derived();
	delete base;

虚函数表如下图：

0x02 多重继承（无虚函数覆盖）

class Base {

public:
	Base() { ALOGD("Base ..."); }
	virtual void f() { ALOGD("Base::f"); }
	virtual void g() { ALOGD("Base::g"); }
	virtual void h() { ALOGD("Base::h"); }

	virtual ~Base() { ALOGD("~Base ...");  }

};

class Base1 {

public:
	Base1() { ALOGD("Base1 ..."); }
	virtual void f() { ALOGD("Base1::f"); }
	virtual void g() { ALOGD("Base1::g"); }
	virtual void h() { ALOGD("Base1::h"); }

	virtual ~Base1() {ALOGD("~Base1 ...");}
};

class Base2 {

public:
	Base2() { ALOGD("Base2 ..."); }
	virtual void f() { ALOGD("Base2::f"); }
	virtual void g() { ALOGD("Base2::g"); }
	virtual void h() { ALOGD("Base2::h"); }

	virtual ~Base2() { ALOGD("~Base2 ..."); }

};

class Derived : public Base , public Base1 ,public Base2{

public:
	Derived() : Base()
	{ ALOGD("Derived ...");}
	virtual void f1() { ALOGD("Derived::f"); }
	virtual void g1() { ALOGD("Derived::g"); }
	virtual void h1() { ALOGD("Derived::h"); }

	virtual ~Derived()
	{ ALOGD("~Derived ...");  }
};

Base* base;
	base = new Derived();
	delete base;

虚函数表如下：

.data.rel.ro:00003DD8
.data.rel.ro:00003DD8 ; Segment type: Pure data
.data.rel.ro:00003DD8                 AREA .data.rel.ro, DATA, ALIGN=3
.data.rel.ro:00003DD8                 ; ORG 0x3DD8
.data.rel.ro:00003DD8                 WEAK _ZTV4Base
.data.rel.ro:00003DD8 ; `vtable for'Base
.data.rel.ro:00003DD8 _ZTV4Base       DCB    0                ; DATA XREF: Base::~Base()+8o
.data.rel.ro:00003DD8                                         ; Derived::Derived(void)+Eo ...
.data.rel.ro:00003DD9                 DCB    0
.data.rel.ro:00003DDA                 DCB    0
.data.rel.ro:00003DDB                 DCB    0
.data.rel.ro:00003DDC                 DCB    0
.data.rel.ro:00003DDD                 DCB    0
.data.rel.ro:00003DDE                 DCB    0
.data.rel.ro:00003DDF                 DCB    0
.data.rel.ro:00003DE0                 DCD _ZN4Base1fEv+1
.data.rel.ro:00003DE4                 DCD _ZN4Base1gEv+1
.data.rel.ro:00003DE8                 DCD _ZN4Base1hEv+1
.data.rel.ro:00003DEC                 DCD _ZN4BaseD2Ev+1
.data.rel.ro:00003DF0                 DCD _ZN4BaseD0Ev+1
.data.rel.ro:00003DF4                 ALIGN 8
.data.rel.ro:00003DF8                 WEAK _ZTV5Base1
.data.rel.ro:00003DF8 ; `vtable for'Base1
.data.rel.ro:00003DF8 _ZTV5Base1      DCB    0                ; DATA XREF: Base1::~Base1()+8o
.data.rel.ro:00003DF8