CCSIExternalTransformerExecutor和 CCSIExternalTransformerExecutor::Impl

CCSIExternalTransformerExecutor 有 8 个字段;

CCSIExternalTransformerExecutor::Impl 有 50 个字段。

两者是否有关系，是父子类吗？

(571d3d7c)

(int*)vfptr-2

CCSIExternalTransformerExecutor 有 8 个字段

+0 +1 +2 +3 +4 +5 +6 +7

571d3d98 00000002 571d3d7c 00000009 006c444800000000 00000000 00000000

+0

CComObjectBase 的地址

CComObject::`vftable':

572996f0 57430960573b4b20 57265040 5729f9e0 5729ff00 5729fee0

+1

+2

ICSIExternalTransformerExecutor 的地址

CComObject::`vftable':

5729b520 57285f10572686e0 5729abf0 5729b340 5729bc20 57299b80

+3

+4

CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff的地址

+5

+6

+7

CSystemIsolationLayer

+0 +1 +2

571d4724 006beae0 571d42f4

+0

CCdfBinaryTableEnumerator的地址

+1

57203a54 00000001006beae0 5744d740 006b9548 006c4150 006c4170 006b9508

+2

CSystemIsolationLayer_IRtlSystemIsolationLayerTearoff的地址

//----- (100C9723) --------------------------------------------------------

_DWORD *__thiscall Windows::Auto<CComObject<CCSIExternalTransformerExecutor> *>::Allocate(_DWORD *this)
{
v1 =this;
result =operator new((void *)0x20);
if (result )
{
result[3] = 0xFFFF;
result[1] = 0;
result[4] = 0;
result[5] = 0;
result[6] = 0;
result[7] = 0;
*result= &CComObject<CCSIExternalTransformerExecutor>::`vftable'{for`CComObjectBase'}; // 10003D98
result[2] = &CComObject<CCSIExternalTransformerExecutor>::`vftable'{for`ICSIExternalTransformerExecutor'};// 10003D7C
}
else
{
result =0;
}
*v1= result;
return result;
}
// 10003D7C: using guessed type void*CComObject::`vftable'{for`ICSIExternalTransformerExecutor'};
// 10003D98: using guessed type int (__thiscall*CComObject::`vftable'{for`CComObjectBase'})(PVOID Address, char);
//----- (100C9766)--------------------------------------------------------

CCSIExternalTransformerExecutor::Impl *__thiscallAutoPimplPtr<CCSIExternalTransformerExecutor::Impl>::Allocate(

CCSIExternalTransformerExecutor::Impl **this)
{
v1 =this;
v2 =0;
if (*this )
RtlRaiseStatus(C00000E5);
v1[1] = (CCSIExternalTransformerExecutor::Impl*)Windows::`anonymousnamespace'::CloseWithDelete;
v3 =(CCSIExternalTransformerExecutor::Impl *)RtlAllocateHeap(
*(HANDLE *)(__readfsdword(48) + 24),
0,
0xC8u);
if (v3 )
v2 =CCSIExternalTransformerExecutor::Impl::Impl(v3);
*v1= v2;
return v2;
}
//----- (100C9284)--------------------------------------------------------

CCSIExternalTransformerExecutor::Impl *__thiscallCCSIExternalTransformerExecutor::Impl::Impl(CCSIExternalTransformerExecutor::Impl*this)
{

v1 =this;
*(_DWORD *)this =0;
*((_DWORD *)this +1) = 0;
*((_DWORD *)this +2) = 0;
CTransactionContent::CTransactionContent((

CCSIExternalTransformerExecutor::Impl *)((char*)this+ 12));
*((_DWORD *)v1 + 24) = 0;
*((_DWORD *)v1 + 25) = 0;
*((_DWORD *)v1 + 26) = 0;
*((_DWORD *)v1 + 27) = 0;
*((_DWORD *)v1 + 28) = 0;
*((_DWORD *)v1 + 29) = 0;
CRegistryKey::CRegistryKey((

CCSIExternalTransformerExecutor::Impl *)((char*)v1+ 120)); // +30
Windows::Rtl::AutoHive::AutoHive((

CCSIExternalTransformerExecutor::Impl *)((char*)v1+ 172)); // +43
*((_DWORD *)v1 + 49) = 0;
return v1;
}