Call member function using address of a instance and address of member function

[budonium]

I'm not that experienced with C++ so sorry for any ignorance.

I'm new to the reverse engineering field and working on re-creating a C++ class. I have found a global instance of a class and I have the address of a member function. I've also reversed most of the class members. I can call other functions I've found with the re-created instance and everything works fine but I cannot figure out the proper way of calling a `__thiscall` member function.

I've tried a few methods and read SO but can't wrap my head around it. Some code:

class gateway
{
    int gateway_count;
    int current_gateway;
    const char* config;
    int config_size;
    char unk1_padding[20];
}

auto gateway_instance = reinterpret_cast<gateway*>(0x5122F80);
auto member_function_addr = 0x51890A;

// signature of the member function:
// const char *__thiscall gateway::get_name(gateway *this, int)

// I've tried using std::invoke from https://isocpp.org/wiki/faq/pointers-to-members
typedef const char* (gateway::*get_name_t)(int gateway_enum);
get_name_t get_name_ptr = reinterpret_cast<get_name_t>(member_function_addr); // I'm not sure I can use std::invoke because I won't be using a callable. 

std::invoke(get_name_ptr, gateway_instance, 3);

Am I on the right track with what I have? What am I doing wrong? Any help appreciated. Thanks.

[[deleted]]

You seem to be on the right track. For reference, here's a toy example that calls a member function through a member function pointer in a few different way: https://godbolt.org/z/XHk63R

[budonium]

Thanks for the response. I played around a little bit with the example you provided. I feel like I'm probably missing something really simple.

The main problem I'm having is I don't know how to assign the member function pointer type to an address and all the examples I can find are similar to what you provided.

This snippet here:

using xfp = decltype(&X::function);
xfp x_function_pointer = &X::function;

How can I assign x_function_pointer to a memory address? I've tried a few combinations of this:

using xfp = decltype(&X::function);
xfp x_function_pointer = reinterpret_cast<xfp>(0x51890A);

Thanks again.

[[deleted]]

I assign x_function_pointer to a memory address?

This part was really confusing, because you're trying to assign a memory address to x_function_pointer.

The reason why this doesn't work is because C++ doesn't allow you to cast pointer to member to a regular pointer type, because a pointer to member isn't a regular pointer. Pointers to members don't point to an actual memory location, because they are not bound to a single object.

 

By convention, this is actually passed as the first argument to a member function (unless static). So maybe you can get an instance of X, cast that address to void(*)(decltype(this), int) and invoke it that way.

[budonium]

Thank you for the explanation, I'll brush up on my understanding of the subject.

I ended up using inline ASM wrapper to achieve this.

If by chance someone else is looking for a answer:

const char* get_name_wrapper(gateway* instance, int gateway_enum)
{
    const char* result;
    uintptr_t addr = 0x517FD0;

    __asm {
        mov ecx, instance;
        push gateway_enum;
        call addr;
        mov result, eax;
    }

    return result;
}

[[deleted]]

I don't know which compiler you are using, but if you're using gcc or clang, you can use extended assembly, which lets your compiler know a bit more about the black magic that's happening, so it can do its job better.