调用__thiscall DLL类构造函数时重复获取相同this指针的问题排查

我正在逆向一个DLL文件，想要在x86 C++代码中直接调用其中某个类的构造函数，但没有该类的结构信息和头文件。已知该构造函数的调用约定为__thiscall，按照该约定，this指针通过ecx寄存器传递，而非栈传递。

我原本期望通过五次调用该构造函数得到五个不同的this指针，但实际运行代码后，每次得到的this指针值都完全相同。

初始代码 #

#include <iostream>
#include <Windows.h>

int main()
{
    typedef void (__thiscall* CTOR)(void);

    HMODULE dll = LoadLibraryA(R"(MYDLL.dll)");
    if (!dll)
        std::cout << "can not load dll error: " << GetLastError() << std::endl;
    else
    {       
        void* default_ctor_this_pointer = ::operator new(4);

        if (default_ctor_this_pointer)
        {
            for (std::size_t i = 0; i < 5; i++)
            {
                std::memset(default_ctor_this_pointer, 0, 4);

                CTOR default_ctor = (CTOR)(GetProcAddress(dll, "??0TestClass@@QAE@XZ"));
                std::cout << "\t[+]TestClass::TestClass() = 0x" << default_ctor << " --> error: " << GetLastError() << std::endl;
                std::cout << "\t\t[-]this_pointer before call: 0x" << std::hex << *(unsigned*)default_ctor_this_pointer << std::dec << std::endl;       
                _asm {mov ecx, default_ctor_this_pointer};
                default_ctor();
                _asm {mov default_ctor_this_pointer, ecx};
                std::cout << "\t\t[-]this_pointer after call: 0x" << std::hex << *(unsigned*)default_ctor_this_pointer << std::dec << std::endl;
            }
        }
    }

    return 0;
}

初始代码输出 #

[+]TestClass::TestClass() = 0x62995440 --> error: 0
    [-]this_pointer before call: 0x0
    [-]this_pointer after call: 0x62a7d8d8
[+]TestClass::TestClass() = 0x62995440 --> error: 0
    [-]this_pointer before call: 0x0
    [-]this_pointer after call: 0x62a7d8d8
[+]TestClass::TestClass() = 0x62995440 --> error: 0
    [-]this_pointer before call: 0x0
    [-]this_pointer after call: 0x62a7d8d8
[+]TestClass::TestClass() = 0x62995440 --> error: 0
    [-]this_pointer before call: 0x0
    [-]this_pointer after call: 0x62a7d8d8
[+]TestClass::TestClass() = 0x62995440 --> error: 0
    [-]this_pointer before call: 0x0
    [-]this_pointer after call: 0x62a7d8d8

修改后的代码（根据建议调整） #

#include <iostream>
#include <Windows.h>

int main()
{
    typedef void (__thiscall* CTOR)(void);

    HMODULE dll = LoadLibraryA(R"(MYDLL.dll)");
    if (!dll)
        std::cout << "can not load dll error: " << GetLastError() << std::endl;
    else
    {       
        void* default_ctor_this_pointer = ::operator new(4096);

        if (default_ctor_this_pointer)
        {
            for (std::size_t i = 0; i < 5; i++)
            {
                std::memset(default_ctor_this_pointer, 0, 4096);

                CTOR default_ctor = (CTOR)(GetProcAddress(dll, "??0TestClass@@QAE@XZ"));
                std::cout << "\t[+]TestClass::TestClass() = 0x" << default_ctor << " --> error: " << GetLastError() << std::endl;
                std::cout << "\t\t[-]this_pointer before call: 0x" << std::hex << *(unsigned*)default_ctor_this_pointer << std::dec << std::endl;       
                _asm {mov ecx, default_ctor_this_pointer};
                default_ctor();
                _asm {mov default_ctor_this_pointer, eax};
                std::cout << "\t\t[-]this_pointer after call: 0x" << std::hex << *(unsigned*)default_ctor_this_pointer << std::dec << std::endl;
                std::cout << "\t\t\t[-]";
                for(std::size_t j = 0; j < 10; j++)
                {
                    std::cout << "0x" << std::hex << ((unsigned char*)default_ctor_this_pointer)[j] << " " << std::dec;
                } std::cout << "\n";
            }
        }
    }

    return 0;
}

修改后的代码输出 #

[+]TestClass::TestClass = 0x62955C40 --> error: 0
        [-]this_pointer before call: 0x0
        [-]this_pointer after call: 0x62ab2380
            [-]0x62ab2380 0x62ab0160 0x0 0x62ab23ac 0x940c70 0x0 0x0 0x0 0x0 0x0
    [+]TestClass::TestClass = 0x62955C40 --> error: 0
        [-]this_pointer before call: 0x0
        [-]this_pointer after call: 0x62ab2380
            [-]0x62ab2380 0x62ab0160 0x0 0x62ab23ac 0x940798 0x0 0x0 0x0 0x0 0x0
    [+]TestClass::TestClass = 0x62955C40 --> error: 0
        [-]this_pointer before call: 0x0
        [-]this_pointer after call: 0x62ab2380
            [-]0x62ab2380 0x62ab0160 0x0 0x62ab23ac 0x940950 0x0 0x0 0x0 0x0 0x0
    [+]TestClass::TestClass = 0x62955C40 --> error: 0
        [-]this_pointer before call: 0x0
        [-]this_pointer after call: 0x62ab2380
            [-]0x62ab2380 0x62ab0160 0x0 0x62ab23ac 0x940900 0x0 0x0 0x0 0x0 0x0
    [+]TestClass::TestClass = 0x62955C40 --> error: 0
        [-]this_pointer before call: 0x0
        [-]this_pointer after call: 0x62ab2380
            [-]0x62ab2380 0x62ab0160 0x0 0x62ab23ac 0x940978 0x0 0x0 0x0 0x0 0x0

疑问 #

我的操作流程是否存在错误？为何无法获取到不同的this指针？

内容的提问来源于stack exchange，提问作者Iman Abdollahzadeh