|
implementation
{$R *.dfm}
type
TWorker = class(TObject)
public
Name: string;
Age: Cardinal;
procedure SetWorker(sName: string; nAge: Cardinal);
end;
procedure TWorker.SetWorker(sName: string; nAge: Cardinal);
begin
Name := sName;
Age := nAge;
end;
procedure TForm1.Button1Click(Sender: TObject);
var
Worker: TWorker;
begin
Worker := TWorker.Create;
Worker.SetWorker('Marx', 55);
end;
反汇编代码如下。
CODE:0044E00C _TForm1_Button1Click proc near ; DATA XREF: CODE:0044DF10o
CODE:0044E00C mov dl, 1
CODE:0044E00E mov eax, off_44DF50
CODE:0044E013 call unknown_libname_26 ; BDS 2005-2007 and Delphi6-7 Visual Component Library ;TWorker.Create
CODE:0044E018 mov ecx, 37h ;nAge
CODE:0044E01D mov edx, offset _str_Marx.Text ;sString
CODE:0044E022 call sub_44DFB8 ;Worker.SetWorker
CODE:0044E027 retn
CODE:0044E027 _TForm1_Button1Click endp
调用TWorker.Create后，成功返回一个对象的实例，接着，按照fastcall调用约定，调用了Worker.SetWorker方法。
此处实际隐含了一个Self指针，即C++里的this指针。
| 寄存器 |
说明 |
| EAX |
Self |
| EDX |
sString |
| ECX |
nAge |
Work.SetWorker的反汇编代码如下。
CODE:0044DFB8 sub_44DFB8 proc near ; CODE XREF: _TForm1_Button1Click+16p
CODE:0044DFB8
CODE:0044DFB8 var_4 = dword ptr -4
CODE:0044DFB8
CODE:0044DFB8 push ebp
CODE:0044DFB9 mov ebp, esp
CODE:0044DFBB push ecx
CODE:0044DFBC push ebx
CODE:0044DFBD push esi
CODE:0044DFBE mov esi, ecx
CODE:0044DFC0 mov [ebp+var_4], edx
CODE:0044DFC3 mov ebx, eax ; EBX - > Self
CODE:0044DFC5 mov eax, [ebp+var_4]
CODE:0044DFC8 call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *)
CODE:0044DFCD xor eax, eax
CODE:0044DFCF push ebp
CODE:0044DFD0 push offset loc_44DFFF
CODE:0044DFD5 push dword ptr fs:[eax]
CODE:0044DFD8 mov fs:[eax], esp
CODE:0044DFDB lea eax, [ebx+4] ; EAX - > Self + 4
CODE:0044DFDE mov edx, [ebp+var_4] ; EDX - > sName
CODE:0044DFE1 call @System@@LStrAsg$qqrpvpxv ; 执行字符串拷贝工作
CODE:0044DFE6 mov [ebx+8], esi ; [Self + 8] = nAge
CODE:0044DFE9 xor eax, eax
CODE:0044DFEB pop edx
CODE:0044DFEC pop ecx
CODE:0044DFED pop ecx
CODE:0044DFEE mov fs:[eax], edx
此时，Worker的内存布局如下。
00943DB0 9C DF 44 00 C8 3D 94 00 37 00 00 00 溸D.??7.....
0x943DC8指向[Marx]字符串，0x37（55）即nAge。
implementation
{$R *.dfm}
type
TClassA = class(TObject)
public
procedure GetName(); virtual;
end;
procedure TClassA.GetName();
begin
ShowMessage('My Name is "TClassA"');
end;
procedure TForm1.Button1Click(Sender: TObject);
var
ClassA: TClassA;
begin
classA := TClassA.Create;
ClassA.GetName;
ClassA.Free;
end;
反汇编代码如下。
此时ClassA的内存构造如下。
00953D8C 48 27 45 00 H'E.
0x452748的内存如下。
00452748 54 27 45 00 T'E.
0x452754，即虚方法地址。
反汇编代码如下。
00452754 . B8 68274500 mov eax,Project1.00452768
00452759 . E8 2E8DFDFF call Project1.0042B48C
0045275E . C3 retn
implementation
{$R *.dfm}
type
TClassA = class(TObject)
public
procedure GetName(); virtual;
end;
TClassB = class(TClassA)
public
procedure GetAge(); virtual;
procedure GetInfor(); virtual;
end;
procedure TClassA.GetName();
begin
ShowMessage('My Name is "TClassA"');
end;
procedure TClassB.GetAge();
begin
ShowMessage('I am 16');
end;
procedure TClassB.GetInfor();
begin
ShowMessage('I am a senior school teacher');
end;
procedure TForm1.Button1Click(Sender: TObject);
var
ClassB: TClassB;
begin
ClassB := TClassB.Create;
ClassB.GetName();
ClassB.GetAge();
ClassB.GetInfor();
ClassB.Free;
end;
反汇编代码如下。
CODE:00452830 _TForm1_Button1Click proc near ; DATA XREF: CODE:004526BCo
CODE:00452830 push ebx
CODE:00452831 mov dl, 1
CODE:00452833 mov eax, off_452754
CODE:00452838 call unknown_libname_26 ; BDS 2005-2007 and Delphi6-7 Visual Component Library
CODE:0045283D mov ebx, eax
CODE:0045283F mov eax, ebx
CODE:00452841 mov edx, [eax]
CODE:00452843 call dword ptr [edx]
CODE:00452845 mov eax, ebx
CODE:00452847 mov edx, [eax]
CODE:00452849 call dword ptr [edx+4]
CODE:0045284C mov eax, ebx
CODE:0045284E mov edx, [eax]
CODE:00452850 call dword ptr [edx+8]
CODE:00452853 mov eax, ebx ; this
CODE:00452855 call @System@TObject@Free$qqrv ; System::TObject::Free(void)
CODE:0045285A pop ebx
CODE:0045285B retn
CODE:0045285B _TForm1_Button1Click endp
此时ClassB的内存构造如下。
00953D8C A0 27 45 00 ?E..
0x4527A0的内存如下。
004527A0 B4 27 45 00 E0 27 45 00 FC 27 45 00 ?E.?E.?E.TC
0x4527B4、0x4527E0、0x4527FC。这是虚方法表，分别对应了3个虚方法。其中第一个是从父类TClassA里继承下来的。
implementation
{$R *.dfm}
type
TClassA = class(TObject)
public
procedure GetName(); dynamic;
end;
procedure TClassA.GetName();
begin
ShowMessage('I am Mike');
end;
procedure TForm1.Button1Click(Sender: TObject);
var
ClassA: TClassA;
begin
ClassA := TClassA.Create;
ClassA.GetName();
ClassA.Free;
end;
反汇编代码如下。
CODE:00452778 _TForm1_Button1Click proc near ; DATA XREF: CODE:004526BCo
CODE:00452778 push ebx
CODE:00452779 push esi
CODE:0045277A mov dl, 1
CODE:0045277C mov eax, off_4526FC
CODE:00452781 call unknown_libname_26 ; BDS 2005-2007 and Delphi6-7 Visual Component Library
CODE:00452786 mov ebx, eax
CODE:00452788 mov eax, ebx
CODE:0045278A mov si, 0FFFFh
CODE:0045278E call @System@@CallDynaInst$qqrv ; System::__linkproc__ CallDynaInst(void)
CODE:00452793 mov eax, ebx ; this
CODE:00452795 call @System@TObject@Free$qqrv ; System::TObject::Free(void)
CODE:0045279A pop esi
CODE:0045279B pop ebx
CODE:0045279C retn
CODE:0045279C _TForm1_Button1Click endp
与虚方法的调用不同，动态方法使用索引调用，而且是通过CallDynaInst这个库函数实现。
而该库函数只是简单的从Self指针里取出了VMT（[Self + 0]），就转给另一个库函数了。该库函数的反汇编代码如下。
CODE:00403668 unknown_libname_28 proc near ; CODE XREF: System::__linkproc__ CallDynaInst(void)+4p
CODE:00403668 ; System::__linkproc__ FindDynaInst(void)+5p ...
CODE:00403668 push edi
CODE:00403669 xchg eax, esi
CODE:0040366A jmp short loc_40366E
CODE:0040366C ; ---------------------------------------------------------------------------
CODE:0040366C
CODE:0040366C loc_40366C: ; CODE XREF: unknown_libname_28+1Fj
CODE:0040366C mov esi, [esi]
CODE:0040366E
CODE:0040366E loc_40366E: ; CODE XREF: unknown_libname_28+2j
CODE:0040366E mov edi, [esi-30h]
CODE:00403671 test edi, edi
CODE:00403673 jz short loc_403682
CODE:00403675 movzx ecx, word ptr [edi]
CODE:00403678 push ecx
CODE:00403679 add edi, 2
CODE:0040367C repne scasw
CODE:0040367F jz short loc_40368B
CODE:00403681 pop ecx
CODE:00403682
CODE:00403682 loc_403682: ; CODE XREF: unknown_libname_28+Bj
CODE:00403682 mov esi, [esi-24h]
CODE:00403685 test esi, esi
CODE:00403687 jnz short loc_40366C
CODE:00403689 pop edi
CODE:0040368A retn
CODE:0040368B ; ---------------------------------------------------------------------------
CODE:0040368B
CODE:0040368B loc_40368B: ; CODE XREF: unknown_libname_28+17j
CODE:0040368B pop eax
CODE:0040368C add eax, eax
CODE:0040368E sub eax, ecx
CODE:00403690 mov esi, [edi+eax*2-4]
CODE:00403694 pop edi
CODE:00403695 retn
CODE:00403695 unknown_libname_28 endp
代码我没有标注释，简单解释一下意思吧。首先，从[VMT– 0x30]处，得到动态方法的表起始地址。
本例中的动态方法表如下。
00452748 01 00 FF FF 58 27 45 00 .X'E.
| 偏移 |
长度 |
说明 |
| 0x0 |
2 |
动态方法数，本例中为1 |
| 0x2 |
2 |
第一个动态方法的索引序号 |
| 0x4 |
4 |
第一个动态方法的地址 |
然后调用串操作指令对该动态方法表进行扫描，本例中ClassA.GetName动态方法的索引序号为0xFFFF。
procedure TForm1.Edit1MouseDown(Sender: TObject; Button: TMouseButton;
Shift: TShiftState; X, Y: Integer);
begin
if Button = mbLeft then
(Sender as TEdit).BeginDrag(False);
end;
procedure TForm1.Memo1DragOver(Sender, Source: TObject; X, Y: Integer;
State: TDragState; var Accept: Boolean);
begin
if (Source is TEdit) then
Accept := True;
end;
procedure TForm1.Memo1DragDrop(Sender, Source: TObject; X, Y: Integer);
begin
if (Sender is TMemo) and (Source is TEdit) then
Memo1.Lines.Add((Source as TEdit).Text);
end;
这是拖放事件的一个小应用。
用户将Edit拖动到Memo上时，则Edit里的内容会被添加到Memo中。
反汇编代码如下。
CODE:0044FCF0 _TForm1_Memo1DragOver proc near ; DATA XREF: CODE:0044FC6Fo
CODE:0044FCF0
CODE:0044FCF0 arg_0 = dword ptr 8
CODE:0044FCF0
CODE:0044FCF0 push ebp
CODE:0044FCF1 mov ebp, esp
CODE:0044FCF3 push ebx
CODE:0044FCF4 mov ebx, ecx
CODE:0044FCF6 mov eax, ebx
CODE:0044FCF8 mov edx, off_425848
CODE:0044FCFE call @System@@IsClass$qqrp14System@TObjectp17System@TMetaClass ; System::__linkproc__ IsClass(System::TObject *,System::TMetaClass *)
CODE:0044FD03 test al, al
CODE:0044FD05 jz short loc_44FD0D
CODE:0044FD07 mov eax, [ebp+arg_0]
CODE:0044FD0A mov byte ptr [eax], 1
CODE:0044FD0D
CODE:0044FD0D loc_44FD0D: ; CODE XREF: _TForm1_Memo1DragOver+15j
CODE:0044FD0D pop ebx
CODE:0044FD0E pop ebp
CODE:0044FD0F retn 10h
CODE:0044FD0F _TForm1_Memo1DragOver endp
CODE:00403628 test eax, eax
CODE:0040362A jz short locret_403642
CODE:0040362C mov ecx, eax
CODE:0040362E
CODE:0040362E loc_40362E: ; CODE XREF: System::__linkproc__ AsClass(System::TObject *,System::TMetaClass *)+11j
CODE:0040362E mov ecx, [ecx]
CODE:00403630 cmp ecx, edx
CODE:00403632 jz short locret_403642
CODE:00403634 mov ecx, [ecx-24h]
CODE:00403637 test ecx, ecx
CODE:00403639 jnz short loc_40362E
CODE:0040363B mov al, 0Ah
CODE:0040363D jmp @System@Error$qqr20System@TRuntimeError ; System::Error(System::TRuntimeError)
CODE:00403642 ; ---------------------------------------------------------------------------
CODE:00403642
CODE:00403642 locret_403642: ; CODE XREF: System::__linkproc__ AsClass(System::TObject *,System::TMetaClass *)+2j
CODE:00403642 ; System::__linkproc__ AsClass(System::TObject *,System::TMetaClass *)+Aj
CODE:00403642 retn
只是取出Source的VMT进行比对。
implementation
{$R *.dfm}
type
TClassA = class(TObject)
public
procedure GetName(); virtual;
end;
procedure TClassA.GetName();
begin
ShowMessage('我是ClassA');
end;
procedure MyGetName(Self: Cardinal);
begin
ShowMessage('我才不是什么ClassA');
end;
procedure TForm1.Button1Click(Sender: TObject);
var
ClassA: TClassA;
pVMT: Pointer;
dwFlag: Cardinal;
begin
ClassA := TClassA.Create;
ClassA.GetName(); //第一次正常调用
//开始HOOK
pVMT := Pointer(PCardinal(ClassA)^); //得到VMT
VirtualProtect(pVMT, 4, PAGE_READWRITE, dwFlag); //修改VMT的内存属性为可写
PCardinal(pVMT)^ := Cardinal(@MyGetName); //替换
VirtualProtect(pVMT, 4, dwFlag, dwFlag); //还原VMT的内存属性
ClassA.GetName(); //第二次非正常调用
ClassA.Free;
end;
只要得到VMT，并对其中的虚方法表进行替换就可以了。前提必须知道要HOOK的虚方法的索引位置。
本文权当抛砖引玉，如果想要更深入研究，请阅读Delphi帮助文件中和RTTI有关的内容。
|
客服电话
APP下载
官方微信
请发表评论