# X86 Disassembly/Objects and Classes

## Object-Oriented Programming

**Object-Oriented** (OO) programming provides for us a new unit of
program structure to contend with: the **Object**. This chapter will
look at disassembled classes from C++. This chapter will not deal
directly with COM, but it will work to set a lot of the groundwork for
future discussions in reversing COM components (Windows users only).

## Classes

A basic class that has not inherited anything can be broken into two
parts, the variables and the methods. The non-static variables are
shoved into a simple data structure while the methods are compiled and
called like every other function.

When you start adding in inheritance and polymorphism, things get a
little more complicated. For the purposes of simplicity, the structure
of an object will be described in terms of having no inheritance. At the
end, however, inheritance and polymorphism will be covered.

### Variables

All static variables defined in a class resides in the static region of
memory for the entire duration of the application. Every other variable
defined in the class is placed into a data structure known as an object.
Typically when the constructor is called, the variables are placed into
the object in sequential order, see **Figure 1**.

`<small>`{=html}A:`</small>`{=html}

``` cpp
class ABC123 {
public:
    int a, b, c;
    ABC123():a(1), b(2), c(3) {};
};
```

`<small>`{=html}B:`</small>`{=html}

``` asm
0x00200000  dd  1   ;int a
0x00200004  dd  2   ;int b
0x00200008  dd  3   ;int c
```

```{=html}
<table width=95%>
```
```{=html}
<tr>
```
```{=html}
<td>
```
`<small>`{=html}**Figure 1**: An example of what an object looks like in
memory`</br>`{=html} **Figure 1.A**: The definition for the class
\"ABC123.\" This class has three integers, a, b, and c. The constructor
sets \'a\' to equal 1, \'b\' to equal 2, and \'c\' to equal
3.`</br>`{=html} **Figure 1.B**: How the object ABC123 might be placed
in memory, ordering the variables from the class sequentially. At memory
address 0x00200000 there is a double word integer (32 bits) with a value
of 1, representing the variable \'a\'. Memory address 0x00200004 has a
double word integer with the value of 2, representing the variable
\'b\'. And at memory address 0x00200008 there is a double word integer
with a value of 3, representing the variable \'c\'.`</small>`{=html}

```{=html}
</td>
```
```{=html}
</tr>
```
```{=html}
</table>
```
However, the compiler typically needs the variables to be separated into
sizes that are multiples of a word (2 bytes) in order to locate them.
Not all variables fit this requirement, namely char arrays; some unused
bits might be used pad the variables so they meet this size requirement.
This is illustrated in **Figure 2**.

`<small>`{=html}A:`</small>`{=html}

``` cpp
class ABC123{
public:
    int a;
    char b[3];
    double c;

    ABC123():a(1),c(3) { strcpy(b,"02"); };
};
```

`<small>`{=html}B:`</small>`{=html}

``` asm
0x00200000  dd  1       ;int a              ; offset = abc123 + 0*word_size
0x00200004  db  '0'     ;b[0] = '0'         ; offset = abc123 + 2*word_size
0x00200005  db  '2'     ;b[1] = '2'
0x00200006  db  0       ;b[2] = null
0x00200007  db  0       ;<= UNUSED BYTE
0x00200008  dd  0x00000000  ;double c,  lower 32 bits   ; offset = abc123 + 4*word_size
0x0020000C  dd  0x40080000  ;double c,  upper 32 bits
```

```{=html}
<table width=95%>
```
```{=html}
<tr>
```
```{=html}
<td>
```
`<small>`{=html}**Figure 2**: An example of an object having a padded
variable`</br>`{=html} **Figure 2.A**: A new definition for the class
\"ABC123.\" This class has one 32 bit integer, a. One 3 byte char array,
b. And one 64 bit double, c. The constrictor sets \'a\' to 1, \'b\' to
\"02\", and \'c\' to 3.`</br>`{=html} **Figure 2.B** Shows how ABC123
might be stored in memory. The first double word in the object is the
variable \'a\' at location 0x00200000 with a value of 1. Variable \'b\'
starts at the memory location 0x00200004. It\'s three bytes containing
three chars, \'0\',\'2\', and the null value. The next available
address, 0x00200007, is unused since it\'s not a multiple of a word. The
last variable \'c\', starts at 0x00200008 and it two double words (64
bits). It contains the value 3.`</small>`{=html}

```{=html}
</td>
```
```{=html}
</tr>
```
```{=html}
</table>
```
In order for the application to access one of these object variables, an
object pointer needs to be offset to find the desired variable. The
offset of every variable is known by the compiler and written into the
object code wherever it\'s needed. **Figure 3** shows how to offset a
pointer to retrieve variables.

``` asm
;abc123 = pointer to object
mov eax, [abc123]   ;eax = &a   ;offset = abc123+0*word_size    = abc123
mov ebx, [abc123+4] ;ebx = &b   ;offset = abc123+2*word_size    = abc123+4
mov ecx, [abc123+8] ;ecx = &c   ;offset = abc123+4*word_size    = abc123+8
```

**Figure 3**: This shows how to offset a pointer to retrieve variables.
The first line places the address of variable \'a\' into eax. The second
line places the address of variable \'b\' into ebx. And the last line
places the variable \'c\' into ecx.

### Methods

At a low level, there is almost no difference between a function and a
method. When decompiling, it can sometimes be hard to tell a difference
between the two. They both reside in the text memory space, and both are
called the same way. An example of how a method is called can be seen in
**Figure 4**.

`<small>`{=html}A:`</small>`{=html}

``` cpp
//method call
abc123->foo(1, 2, 3);
```

`<small>`{=html}B:`</small>`{=html}

``` asm
push 3          ; int c
push 2          ; int b
push 1          ; int a
push [ebp-4]        ; the address of the object
call 0x00434125 ; call to method
```

```{=html}
<table width=95%>
```
```{=html}
<tr>
```
```{=html}
<td>
```
`<small>`{=html}**Figure 4**: A method call.`</br>`{=html} **Figure
4.A**: A method call in the C++ syntax. abc123 is a pointer to an object
that has a method, foo(). foo() is taking three integer arguments, 1, 2,
and 3.`</br>`{=html} **Figure 4.B** The same method call in x86
assembly. It takes four arguments, the address of the object and three
integers. The pointer to the object is at ebp-4 and the method is at
address 0x00434125. `</small>`{=html}

```{=html}
</td>
```
```{=html}
</tr>
```
```{=html}
</table>
```
A notable characteristic in a method call is the address of the object
being passed in as an argument. This, however, is not a always a good
indicator. **Figure 5** shows function with the first argument being an
object passed in by reference. The result is function that looks
identical to a method call.

`<small>`{=html}A:`</small>`{=html}

``` cpp
//function call
foo(abc123, 1, 2, 3);
```

`<small>`{=html}B:`</small>`{=html}

``` asm
push 3          ; int c
push 2          ; int b
push 1          ; int a
push [ebp+4]        ; the address of the object
call 0x00498372 ; call to function
```

```{=html}
<table width=95%>
```
```{=html}
<tr>
```
```{=html}
<td>
```
`<small>`{=html}**Figure 5**: A function call.`</br>`{=html} **Figure
5.A:** A function call in the C++ syntax. foo() is taking four
arguments, one pointer and three integer arguments.`</br>`{=html}
**Figure 5.B:** The same function call in x86 assembly. It takes four
arguments, the address of the object and three integers. The pointer to
the object is at ebp-4 and the method is at address 0x00498372.
`</small>`{=html}

```{=html}
</td>
```
```{=html}
</tr>
```
```{=html}
</table>
```
### Inheritance & Polymorphism

Inheritance and polymorphism completely changes the structure of a
class, the object no longer contains just variables, they also contain
pointers to the inherited methods. This is due to the fact that
polymorphism requires the address of a method or inner object to be
figured out at runtime.

Take **Figure 6** into consideration. How does the application know to
call D::one or C::one? The answer is that the compiler figures out a
convention in which to order variables and method pointers inside the
object such that when they\'re referenced, the offsets are the same for
any object that has inherited its methods and variables.

```{=html}
<center>
```
```{=html}
<table border=0 margin=0 padding=0 width=95%>
```
```{=html}
<tr>
```
```{=html}
<td>
```
``` cpp
A *obj[2];
obj[0] = new C();
obj[1] = new D();

for(int i=0; i<2; i++)
    obj[i]->one();
```

```{=html}
</td>
```
```{=html}
</tr>
```
```{=html}
<tr>
```
```{=html}
<td>
```
`<small>`{=html}**Figure 6**: A small C++ polymorphic loop that calls a
function, one. The classes C and D both inherit an abstract class, A.
The class A, for this code to work, must have a virtual method with the
name, \"one.\" `</small>`{=html}

```{=html}
</td>
```
```{=html}
</tr>
```
```{=html}
</table>
```
```{=html}
</center>
```
The abstract class A acts as a blueprint for the compiler, defining an
expected structure for any class that inherits it. Every variable
defined in class A and every virtual method defined in A will have the
exact same offset for any of its children. **Figure 7** declares a
possible inheritance scheme as well as it structure in memory. Notice
how the offset to C::one is the same as D::one, and the offset to C\'s
copy of A::a is the same as D\'s copy. In this, our polymorphic loop can
just iterate through the array of pointers and know exactly where to
find each method.

`<small>`{=html}A:`</small>`{=html}

``` cpp
class A{
public:
    int a;
    virtual void one() = 0;
};
class B{
public:
    int b;
    int c;
    virtual void two() = 0;
};
class C: public A{
public:
    int d;
    void one();
};
class D: public A, public B{
public:
    int e;
    void one();
    void two();
};
```

`<small>`{=html}B:`</small>`{=html}

``` asm
;Object C
0x00200000  dd  0x00423848  ; address of C::one ;offset = 0*word_size
0x00200004  dd  1       ; C's copy of A::a  ;offset = 2*word_size
0x00200008  dd  4       ; C::d          ;offset = 4*word_size

;Object D
0x00200100  dd  0x00412348  ; address of D::one ;offset = 0*word_size
0x00200104  dd  1       ; D's copy of A::a  ;offset = 2*word_size
0x00200108  dd  0x00431255  ; address of D::two ;offset = 4*word_size
0x0020010C  dd  2       ; D's copy of B::b  ;offset = 6*word_size
0x00200110  dd  3       ; D's copy of B::c  ;offset = 8*word_size
0x00200114  dd  5       ; D::e          ;offset = 10*word_size
```

```{=html}
<table width=95%>
```
```{=html}
<tr>
```
```{=html}
<td>
```
`<small>`{=html}**Figure 7**: A polymorphic inheritance
scheme.`</br>`{=html} **Figure 7.A** defines the inheritance scheme. It
shows that class C inherits class A, and class D inherits class A and
class B.`</br>`{=html} **Figure 7.B** shows how the inheritance scheme
might be structured in memory. Class C\'s object has everything that was
declared in class A in the first two double words. The remainder of the
object was defined by class C. Class D\'s object also has everything
that was declared in class A in the first two double words. Then the
next three double words is everything declared in class B. And the last
double word is the variable defined by class D.`</small>`{=html}

```{=html}
</td>
```
```{=html}
</tr>
```
```{=html}
</table>
```
## Classes Vs. Structs
