Delphi面向對象編程

• 靜態方法與類字段

implementation

{$R *.dfm}
type

  TWorker = class(TObject)
  public
    Name: string;
    Age: Cardinal;
    procedure SetWorker(sName: string; nAge: Cardinal);
  end;

procedure TWorker.SetWorker(sName: string; nAge: Cardinal);
begin
  Name := sName;
  Age := nAge;
end;

procedure TForm1.Button1Click(Sender: TObject);
var
  Worker: TWorker;
begin
  Worker := TWorker.Create;
  Worker.SetWorker('Marx', 55);
end;

 

反匯編代碼如下。

CODE:0044E00C _TForm1_Button1Click proc near          ; DATA XREF: CODE:0044DF10o
CODE:0044E00C                 mov     dl, 1
CODE:0044E00E                 mov     eax, off_44DF50
CODE:0044E013                 call    unknown_libname_26 ; BDS 2005-2007 and Delphi6-7 Visual Component Library ;TWorker.Create
CODE:0044E018                 mov     ecx, 37h ;nAge
CODE:0044E01D                 mov     edx, offset _str_Marx.Text ;sString
CODE:0044E022                 call    sub_44DFB8 ;Worker.SetWorker
CODE:0044E027                 retn
CODE:0044E027 _TForm1_Button1Click endp

 

調用TWorker.Create后，成功返回一個對象的實例，接着，按照fastcall調用約定，調用了Worker.SetWorker方法。

此處實際隱含了一個Self指針，即C++里的this指針。

寄存器	說明
EAX	Self
EDX	sString
ECX	nAge

 

Work.SetWorker的反匯編代碼如下。

CODE:0044DFB8 sub_44DFB8      proc near               ; CODE XREF: _TForm1_Button1Click+16p
CODE:0044DFB8
CODE:0044DFB8 var_4           = dword ptr -4
CODE:0044DFB8
CODE:0044DFB8                 push    ebp
CODE:0044DFB9                 mov     ebp, esp
CODE:0044DFBB                 push    ecx
CODE:0044DFBC                 push    ebx
CODE:0044DFBD                 push    esi
CODE:0044DFBE                 mov     esi, ecx
CODE:0044DFC0                 mov     [ebp+var_4], edx
CODE:0044DFC3                 mov     ebx, eax        ; EBX - > Self
CODE:0044DFC5                 mov     eax, [ebp+var_4]
CODE:0044DFC8                 call    @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *)
CODE:0044DFCD                 xor     eax, eax
CODE:0044DFCF                 push    ebp
CODE:0044DFD0                 push    offset loc_44DFFF
CODE:0044DFD5                 push    dword ptr fs:[eax]
CODE:0044DFD8                 mov     fs:[eax], esp
CODE:0044DFDB                 lea     eax, [ebx+4]    ; EAX - > Self + 4
CODE:0044DFDE                 mov     edx, [ebp+var_4] ; EDX - > sName
CODE:0044DFE1                 call    @System@@LStrAsg$qqrpvpxv ; 執行字符串拷貝工作
CODE:0044DFE6                 mov     [ebx+8], esi    ; [Self + 8] = nAge
CODE:0044DFE9                 xor     eax, eax
CODE:0044DFEB                 pop     edx
CODE:0044DFEC                 pop     ecx
CODE:0044DFED                 pop     ecx
CODE:0044DFEE                 mov     fs:[eax], edx

 

此時，Worker的內存布局如下。

00943DB0  9C DF 44 00 C8 3D 94 00 37 00 00 00              溸D.??7.....

 

0x943DC8指向[Marx]字符串，0x37（55）即nAge。

• 類的繼承與虛方法

implementation

{$R *.dfm}
type
  TClassA = class(TObject)
  public
    procedure GetName(); virtual;
  end;

procedure TClassA.GetName();
begin
  ShowMessage('My Name is "TClassA"');
end;

procedure TForm1.Button1Click(Sender: TObject);
var
  ClassA: TClassA;
begin
  classA := TClassA.Create;
  ClassA.GetName;
  ClassA.Free;
end;

 

反匯編代碼如下。

此時ClassA的內存構造如下。

00953D8C  48 27 45 00                                      H'E.

 

0x452748的內存如下。

00452748  54 27 45 00                                      T'E.

 

0x452754，即虛方法地址。

反匯編代碼如下。

00452754   .  B8 68274500   mov eax,Project1.00452768
00452759   .  E8 2E8DFDFF   call Project1.0042B48C
0045275E   .  C3            retn

 

implementation

{$R *.dfm}
type
  TClassA = class(TObject)
  public
    procedure GetName(); virtual;
  end;

  TClassB = class(TClassA)
  public
    procedure GetAge(); virtual;
    procedure GetInfor(); virtual;
  end;

procedure TClassA.GetName();
begin
  ShowMessage('My Name is "TClassA"');
end;

procedure TClassB.GetAge();
begin
  ShowMessage('I am 16');
end;

procedure TClassB.GetInfor();
begin
  ShowMessage('I am a senior school teacher');
end;

procedure TForm1.Button1Click(Sender: TObject);
var
  ClassB: TClassB;
begin
  ClassB := TClassB.Create;
  ClassB.GetName();
  ClassB.GetAge();
  ClassB.GetInfor();
  ClassB.Free;
end;

 

反匯編代碼如下。

CODE:00452830 _TForm1_Button1Click proc near          ; DATA XREF: CODE:004526BCo
CODE:00452830                 push    ebx
CODE:00452831                 mov     dl, 1
CODE:00452833                 mov     eax, off_452754
CODE:00452838                 call    unknown_libname_26 ; BDS 2005-2007 and Delphi6-7 Visual Component Library
CODE:0045283D                 mov     ebx, eax
CODE:0045283F                 mov     eax, ebx
CODE:00452841                 mov     edx, [eax]
CODE:00452843                 call    dword ptr [edx]
CODE:00452845                 mov     eax, ebx
CODE:00452847                 mov     edx, [eax]
CODE:00452849                 call    dword ptr [edx+4]
CODE:0045284C                 mov     eax, ebx
CODE:0045284E                 mov     edx, [eax]
CODE:00452850                 call    dword ptr [edx+8]
CODE:00452853                 mov     eax, ebx        ; this
CODE:00452855                 call    @System@TObject@Free$qqrv ; System::TObject::Free(void)
CODE:0045285A                 pop     ebx
CODE:0045285B                 retn
CODE:0045285B _TForm1_Button1Click endp

 

此時ClassB的內存構造如下。

00953D8C  A0 27 45 00                                      ?E..

 

0x4527A0的內存如下。

004527A0  B4 27 45 00 E0 27 45 00 FC 27 45 00              ?E.?E.?E.TC

 

0x4527B4、0x4527E0、0x4527FC。這是虛方法表，分別對應了3個虛方法。其中第一個是從父類TClassA里繼承下來的。

 

• 類的動態方法

implementation

{$R *.dfm}
type
  TClassA = class(TObject)
  public
    procedure GetName(); dynamic;
  end;

procedure TClassA.GetName();
begin
  ShowMessage('I am Mike');
end;

procedure TForm1.Button1Click(Sender: TObject);
var
  ClassA: TClassA;
begin
  ClassA := TClassA.Create;
  ClassA.GetName();
  ClassA.Free;
end;

反匯編代碼如下。

CODE:00452778 _TForm1_Button1Click proc near          ; DATA XREF: CODE:004526BCo
CODE:00452778                 push    ebx
CODE:00452779                 push    esi
CODE:0045277A                 mov     dl, 1
CODE:0045277C                 mov     eax, off_4526FC
CODE:00452781                 call    unknown_libname_26 ; BDS 2005-2007 and Delphi6-7 Visual Component Library
CODE:00452786                 mov     ebx, eax
CODE:00452788                 mov     eax, ebx
CODE:0045278A                 mov     si, 0FFFFh
CODE:0045278E                 call    @System@@CallDynaInst$qqrv ; System::__linkproc__ CallDynaInst(void)
CODE:00452793                 mov     eax, ebx        ; this
CODE:00452795                 call    @System@TObject@Free$qqrv ; System::TObject::Free(void)
CODE:0045279A                 pop     esi
CODE:0045279B                 pop     ebx
CODE:0045279C                 retn
CODE:0045279C _TForm1_Button1Click endp

 

與虛方法的調用不同，動態方法使用索引調用，而且是通過CallDynaInst這個庫函數實現。

而該庫函數只是簡單的從Self指針里取出了VMT（[Self + 0]），就轉給另一個庫函數了。該庫函數的反匯編代碼如下。

CODE:00403668 unknown_libname_28 proc near            ; CODE XREF: System::__linkproc__ CallDynaInst(void)+4p
CODE:00403668                                         ; System::__linkproc__ FindDynaInst(void)+5p ...
CODE:00403668                 push    edi
CODE:00403669                 xchg    eax, esi
CODE:0040366A                 jmp     short loc_40366E
CODE:0040366C ; ---------------------------------------------------------------------------
CODE:0040366C
CODE:0040366C loc_40366C:                             ; CODE XREF: unknown_libname_28+1Fj
CODE:0040366C                 mov     esi, [esi]
CODE:0040366E
CODE:0040366E loc_40366E:                             ; CODE XREF: unknown_libname_28+2j
CODE:0040366E                 mov     edi, [esi-30h]
CODE:00403671                 test    edi, edi
CODE:00403673                 jz      short loc_403682
CODE:00403675                 movzx   ecx, word ptr [edi]
CODE:00403678                 push    ecx
CODE:00403679                 add     edi, 2
CODE:0040367C                 repne scasw
CODE:0040367F                 jz      short loc_40368B
CODE:00403681                 pop     ecx
CODE:00403682
CODE:00403682 loc_403682:                             ; CODE XREF: unknown_libname_28+Bj
CODE:00403682                 mov     esi, [esi-24h]
CODE:00403685                 test    esi, esi
CODE:00403687                 jnz     short loc_40366C
CODE:00403689                 pop     edi
CODE:0040368A                 retn
CODE:0040368B ; ---------------------------------------------------------------------------
CODE:0040368B
CODE:0040368B loc_40368B:                             ; CODE XREF: unknown_libname_28+17j
CODE:0040368B                 pop     eax
CODE:0040368C                 add     eax, eax
CODE:0040368E                 sub     eax, ecx
CODE:00403690                 mov     esi, [edi+eax*2-4]
CODE:00403694                 pop     edi
CODE:00403695                 retn
CODE:00403695 unknown_libname_28 endp

代碼我沒有標注釋，簡單解釋一下意思吧。首先，從[VMT– 0x30]處，得到動態方法的表起始地址。

本例中的動態方法表如下。

00452748  01 00 FF FF 58 27 45 00                          .X'E.

 

偏移	長度	說明
0x0	2	動態方法數，本例中為1
0x2	2	第一個動態方法的索引序號
0x4	4	第一個動態方法的地址

 

然后調用串操作指令對該動態方法表進行掃描，本例中ClassA.GetName動態方法的索引序號為0xFFFF。

• is

procedure TForm1.Edit1MouseDown(Sender: TObject; Button: TMouseButton;
  Shift: TShiftState; X, Y: Integer);
begin
  if Button = mbLeft then
    (Sender as TEdit).BeginDrag(False);
end;

procedure TForm1.Memo1DragOver(Sender, Source: TObject; X, Y: Integer;
  State: TDragState; var Accept: Boolean);
begin
  if (Source is TEdit) then
    Accept := True;
end;

procedure TForm1.Memo1DragDrop(Sender, Source: TObject; X, Y: Integer);
begin
  if (Sender is TMemo) and (Source is TEdit) then
    Memo1.Lines.Add((Source as TEdit).Text);
end;

 

這是拖放事件的一個小應用。

用戶將Edit拖動到Memo上時，則Edit里的內容會被添加到Memo中。

反匯編代碼如下。

CODE:0044FCF0 _TForm1_Memo1DragOver proc near         ; DATA XREF: CODE:0044FC6Fo
CODE:0044FCF0
CODE:0044FCF0 arg_0           = dword ptr  8
CODE:0044FCF0
CODE:0044FCF0                 push    ebp
CODE:0044FCF1                 mov     ebp, esp
CODE:0044FCF3                 push    ebx
CODE:0044FCF4                 mov     ebx, ecx
CODE:0044FCF6                 mov     eax, ebx
CODE:0044FCF8                 mov     edx, off_425848
CODE:0044FCFE                 call    @System@@IsClass$qqrp14System@TObjectp17System@TMetaClass ; System::__linkproc__ IsClass(System::TObject *,System::TMetaClass *)
CODE:0044FD03                 test    al, al
CODE:0044FD05                 jz      short loc_44FD0D
CODE:0044FD07                 mov     eax, [ebp+arg_0]
CODE:0044FD0A                 mov     byte ptr [eax], 1
CODE:0044FD0D
CODE:0044FD0D loc_44FD0D:                             ; CODE XREF: _TForm1_Memo1DragOver+15j
CODE:0044FD0D                 pop     ebx
CODE:0044FD0E                 pop     ebp
CODE:0044FD0F                 retn    10h
CODE:0044FD0F _TForm1_Memo1DragOver endp

 

CODE:00403628                 test    eax, eax
CODE:0040362A                 jz      short locret_403642
CODE:0040362C                 mov     ecx, eax
CODE:0040362E
CODE:0040362E loc_40362E:                             ; CODE XREF: System::__linkproc__ AsClass(System::TObject *,System::TMetaClass *)+11j
CODE:0040362E                 mov     ecx, [ecx]
CODE:00403630                 cmp     ecx, edx
CODE:00403632                 jz      short locret_403642
CODE:00403634                 mov     ecx, [ecx-24h]
CODE:00403637                 test    ecx, ecx
CODE:00403639                 jnz     short loc_40362E
CODE:0040363B                 mov     al, 0Ah
CODE:0040363D                 jmp     @System@Error$qqr20System@TRuntimeError ; System::Error(System::TRuntimeError)
CODE:00403642 ; ---------------------------------------------------------------------------
CODE:00403642
CODE:00403642 locret_403642:                          ; CODE XREF: System::__linkproc__ AsClass(System::TObject *,System::TMetaClass *)+2j
CODE:00403642                                         ; System::__linkproc__ AsClass(System::TObject *,System::TMetaClass *)+Aj
CODE:00403642                 retn

只是取出Source的VMT進行比對。

• 虛表HOOK

implementation

{$R *.dfm}

type
  TClassA = class(TObject)
  public
    procedure GetName(); virtual;
  end;

procedure TClassA.GetName();
begin
  ShowMessage('我是ClassA');
end;

procedure MyGetName(Self: Cardinal);
begin
  ShowMessage('我才不是什么ClassA');
end;

procedure TForm1.Button1Click(Sender: TObject);
var
  ClassA: TClassA;
  pVMT: Pointer;
  dwFlag: Cardinal;
begin
  ClassA := TClassA.Create;
  ClassA.GetName(); //第一次正常調用
  //開始HOOK
  pVMT := Pointer(PCardinal(ClassA)^); //得到VMT
  VirtualProtect(pVMT, 4, PAGE_READWRITE, dwFlag); //修改VMT的內存屬性為可寫
  PCardinal(pVMT)^ := Cardinal(@MyGetName); //替換
  VirtualProtect(pVMT, 4, dwFlag, dwFlag); //還原VMT的內存屬性
  ClassA.GetName(); //第二次非正常調用
  ClassA.Free;
end;

 

只要得到VMT，並對其中的虛方法表進行替換就可以了。前提必須知道要HOOK的虛方法的索引位置。

 

 

• 結尾

本文權當拋磚引玉，如果想要更深入研究，請閱讀Delphi幫助文件中和RTTI有關的內容。