📄 findingclasses.shtml
字号:
<HTML>
<HEAD>
<TITLE>Finding Classes</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF">
<h1><img src="findClasses.gif" width="32" height="32">Finding Classes.</h1>
<h3><A HREF="index.shtml"><img src="decompiler.gif" width="16" height="16" border="0">Decompiler page.</A></h3>
<p>For knowing how to find a class in a program, you first need to known. A class exist only of a
Virtual Method Table (VMT), this
table contains except the virtual methods also information about the class (for more information
search for VMT in the Delphi help file). Including a pointer
to itself at offset vmtSelfPtr, so if you search for addresses with at vmtSelfPtr a pointer back
to the address it most likely is a class.
<PRE>
I := Code - vmtSelfPtr;
while I < Code + PEFileClass.CodeSize do
begin
// vmtSelfPtr must point to itself.
if PPChar(I + vmtSelfPtr)^ = I then
begin
if PPChar(I + vmtParent)^ = nil then
try
// If no classParent then class can be object
if TClass(I).ClassName = 'TObject' then
// if class if object add it to classes.
Add(TClass(I))
except
on EAccessViolation do
end
else
if (PPChar(I + vmtParent)^ <= Code + CodeSize) and
(PPChar(I + vmtParent)^ >= Code) then
// Add possible class to possible class list.
PossClasses.Add(I);
end;
Inc(I, 4);
end;
// Can't be more then 1 TObject.
if Count > 1 then
raise EDecompilerError.Create('There can only be one TObject.');
</PRE>
To filter out real classes search for a class named TObject from the list of possible classes,
<PRE>
// If no classParent then class can be object
if TClass(I).ClassName = 'TObject' then
// if class if object add it to classes.
Add(TClass(I))
</PRE>
After finding TObject, search the list of possible
classes with a already found class as parent, continue this search until no new class is found.
<PRE>
// Add Classes to the list which parent is in the list.
Added := True;
while Added do
begin
Added := False;
for J := PossClasses.Count -1 downto 0 do
// Try to find parent class in classList
if FindClass(TClass(PossClasses[J]).ClassParent) <> nil then
begin
// Class in class list
Add(PossClasses[J]);
PossClasses.Delete(J);
Added := True;
end;
end;
</PRE>
</p>
<hr>
<address> <a href="http://thunder.prohosting.com/~pytho/index.shtml" target="_top"><img src="pythonMini.gif" width=20 height=20 border=0></a>Python<br>
E-mail: <a href="MAILTO:python@softhome.net">python@softhome.net</a> </address>
<HR>
Copyright © 1999 Python. All rights reserved
</BODY>
</HTML>
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -