【Android 逆向】ARM CPP 类对象

#include <stdio.h>

class aclass{
	private:
		int m;
		char c;
	public:
		aclass(int i, char ch) {
			printf("Constructor called.\n");
			this->m = i;
			this->c = ch;
		}
		~aclass() {//定义析构函数
			printf("Destructor called.\n");
		}
		int getM() const {
			return m;
		}
		void setM(int m) {
			this->m = m;
		}
		char getC() const{
			return c;
		}
		void setC(char c) {
			this->c = c;
		}
		int add(int a, int b) {
			printf("%d\n", a+b);
		}
};

int main(int argc, char* argv[]){
	aclass *a = new aclass(3, 'c');
	a->setM(5);
	a->setC('a');
	a->add(2, 8);
	printf("%d\n", a->getM());
	delete a;
	return 0;
}

LOCAL_PATH := $(call my-dir)

include $(CLEAR_VARS)

LOCAL_ARM_MODE := arm
LOCAL_MODULE    := cpp1
LOCAL_SRC_FILES := cpp1.cpp
include $(BUILD_EXECUTABLE)

text:00008600
.text:00008600
.text:00008600
.text:00008600 ; int __cdecl main(int argc, const char **argv, const char **envp)
.text:00008600 main                                    ; CODE XREF: j_main↑j
.text:00008600 ; __unwind {
.text:00008600                 PUSH    {R4-R6,LR}      ; 保存现场
.text:00008604                 MOV     R0, #8          ; unsigned int
.text:00008608                 BL      _Znwj           ; 调用new 创建一个8字节的内存区域
.text:0000860C                 MOV     R4, R0
.text:00008610                 LDR     R0, =(aConstructorCal - 0x8620) ; "Constructor called"的偏移
.text:00008614                 LDR     R5, =(aD - 0x862C) ; “%d\n”的偏移
.text:00008618                 ADD     R0, PC, R0      ; 获取“Constructor called" 首地址
.text:0000861C                 BL      puts            ; 打印“Constructor called”
.text:00008620                 MOV     R3, #5
.text:00008624                 ADD     R5, PC, R5      ; 获取“%d\n”字符串首地址
.text:00008628                 STR     R3, [R4]        ; 把R3的值5，保存到R4对象的前四个字节
.text:0000862C                 MOV     R3, #0x61 ; 'a'
.text:00008630                 STRB    R3, [R4,#4]     ; 把R3的值a，保存到R4所指对象的后四个字节
.text:00008634                 MOV     R1, #0xA        ; R1 = 10，这里编译器直接优化2+8为10
.text:00008638                 MOV     R0, R5          ; format
.text:0000863C                 BL      printf          ; 传入R0 和R1 分别是 “%d\n" 和10
.text:00008640                 LDR     R1, [R4]        ; R1 = 5对象的前四个字节，即字段m的值
.text:00008644                 MOV     R0, R5          ; format
.text:00008648                 BL      printf          ; printf 两个入参 R0 R1
.text:0000864C                 LDR     R0, =(aDestructorCall - 0x8658) ; "Destructor called."
.text:00008650                 ADD     R0, PC, R0      ; 获取“Destructor called" 首地址
.text:00008654                 BL      puts            ; 打印，一个参数编译器会把printf优化为puts
.text:00008658                 MOV     R0, R4          ; void *
.text:0000865C                 BL      _ZdlPv          ; _Zdlpv 为系统调用删除对象 ，R0为对象首地址
.text:00008660                 MOV     R0, #0
.text:00008664                 POP     {R4-R6,PC}      ; 恢复现场
.text:00008664 ; End of function main
.text:00008664