Yesterday we learned about the layout of COM objects and I hinted at "adjustor thunks". If you find yourself debugging in disassembly, you'll sometimes find strange little functions called "adjustor thunks". Let's take another look at the object we laid out last time: In the diagram, p is the pointer returned when the IPersist interface is n...
The Win32 COM calling convention specifies the layout of the virtual method table (vtable) of an object. If a language/compiler wants to support COM, it must lay out its object in the specified manner so other components can use it. It is no coincidence that the Win32 COM object layout matches closely the C++ object layout. Even though COM was o...
A multi-step process.
If you had a program that didn't process messages for a while, but it needed to be painted for whatever reason (say, somebody uncovered it), Windows would eventually lose patience with you and paint your window white. Or at least, that's what people would claim. Actually, Windows is painting your window with your class background brush. Since most...
Disappeared into the cracks.
The last architecture I'm going to cover in this series is the AMD64 architecture (also known as x86-64). The AMD64 takes the traditional x86 and expands the registers to 64 bits, naming them rax, rbx, etc. It also adds eight more general purpose registers, named simply R8 through R15. Here's a sample: On entry to CallThatFunction, the stack lo...
A whirlwind tour of an exotic architecture.
As we learned yesterday, nonstatic member functions take a secret "this" parameter, which makes them incompatible with the function signature required by Win32 callbacks. Fortunately, nearly all callbacks provide some way of providing context. You can shove the "this" pointer into the context so you can reconstruct the source object. Here's an ex...
Okay, here we go: The 32-bit x86 calling conventions. (By the way, in case people didn't get it: I'm only talking in the context of calling conventions you're likely to encounter when doing Windows programming or which are used by Microsoft compilers. I do not intend to cover calling conventions for other operating systems or that are specific to a...
Foreshadowing: This information will actually be useful in a future discussion. Well, not the fine details, but you may notice something that explains... um... it's hard to describe. Just wait for it. Curiously, it is only the 8086 and x86 platforms that have multiple calling conventions. All the others have only one! Now we're going deep into t...
