CCSIExternalTransformerExecutor和 CCSIExternalTransformerExecutor::Impl

CCSIExternalTransformerExecutor和 CCSIExternalTransformerExecutor::Impl

CCSIExternalTransformerExecutor 有 8 個字段;

CCSIExternalTransformerExecutor::Impl 有 50 個字段。

兩者是否有關系，是父子類嗎？

(571d3d7c)

(int*)vfptr-2

CCSIExternalTransformerExecutor 有 8 個字段

+0      +1       +2     +3      +4       +5     +6      +7

571d3d98 00000002 571d3d7c 00000009 006c444800000000 00000000 00000000

+0

CComObjectBase 的位址

CComObject<CCSIExternalTransformerExecutor>::`vftable':

572996f0 57430960573b4b20 57265040 5729f9e0 5729ff00 5729fee0

+1

+2

ICSIExternalTransformerExecutor 的位址

CComObject<CCSIExternalTransformerExecutor>::`vftable':

5729b520 57285f10572686e0 5729abf0 5729b340 5729bc20 57299b80

+3

+4

CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff的位址

+5

+6

+7

CSystemIsolationLayer

+0      +1     +2

571d4724 006beae0 571d42f4

+0

CCdfBinaryTableEnumerator的位址

+1

57203a54 00000001006beae0 5744d740 006b9548 006c4150 006c4170 006b9508

+2

CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff的位址

//----- (100C9723) --------------------------------------------------------

_DWORD *__thiscall Windows::Auto<CComObject<CCSIExternalTransformerExecutor> *>::Allocate(_DWORD *this)

{

  v1 =this;

  result =operator new((void *)0x20);

  if (result )

  {

    result[3] = 0xFFFF;

    result[1] = 0;

    result[4] = 0;

    result[5] = 0;

    result[6] = 0;

    result[7] = 0;

    *result= &CComObject<CCSIExternalTransformerExecutor>::`vftable'{for`CComObjectBase'}; // 10003D98

    result[2] = &CComObject<CCSIExternalTransformerExecutor>::`vftable'{for`ICSIExternalTransformerExecutor'};// 10003D7C

  }

  else

  {

    result =0;

  }

  *v1= result;

  return result;

}

// 10003D7C: using guessed type void*CComObject<CCSIExternalTransformerExecutor>::`vftable'{for`ICSIExternalTransformerExecutor'};

// 10003D98: using guessed type int (__thiscall*CComObject<CCSIExternalTransformerExecutor>::`vftable'{for`CComObjectBase'})(PVOID Address, char);

//----- (100C9766)--------------------------------------------------------

CCSIExternalTransformerExecutor::Impl *__thiscallAutoPimplPtr<CCSIExternalTransformerExecutor::Impl>::Allocate(

CCSIExternalTransformerExecutor::Impl **this)

{

  v1 =this;

  v2 =0;

  if (*this )

    RtlRaiseStatus(C00000E5);

  v1[1] = (CCSIExternalTransformerExecutor::Impl*)Windows::`anonymousnamespace'::CloseWithDelete<CCSIExternalTransformerExecutor::Impl>;

  v3 =(CCSIExternalTransformerExecutor::Impl *)RtlAllocateHeap(

         *(HANDLE *)(__readfsdword(48) + 24),

         0,

         0xC8u);

  if (v3 )

    v2 =CCSIExternalTransformerExecutor::Impl::Impl(v3);

  *v1= v2;

  return v2;

}

//----- (100C9284)--------------------------------------------------------

CCSIExternalTransformerExecutor::Impl *__thiscallCCSIExternalTransformerExecutor::Impl::Impl(CCSIExternalTransformerExecutor::Impl*this)

{

  v1 =this;

  *(_DWORD *)this =0;

  *((_DWORD *)this +1) = 0;

  *((_DWORD *)this +2) = 0;

 CTransactionContent::CTransactionContent((

    CCSIExternalTransformerExecutor::Impl *)((char*)this+ 12));

  *((_DWORD *)v1 + 24) = 0;

  *((_DWORD *)v1 + 25) = 0;

  *((_DWORD *)v1 + 26) = 0;

  *((_DWORD *)v1 + 27) = 0;

  *((_DWORD *)v1 + 28) = 0;

  *((_DWORD *)v1 + 29) = 0;

  CRegistryKey::CRegistryKey((

    CCSIExternalTransformerExecutor::Impl *)((char*)v1+ 120)); // +30

  Windows::Rtl::AutoHive::AutoHive((

    CCSIExternalTransformerExecutor::Impl *)((char*)v1+ 172)); // +43

  *((_DWORD *)v1 + 49) = 0;

  return v1;

}