I've instrumented an application using Frida.RE. I can hook the constructor of a C++ class of my interest, let's call this MyClass::MyClass().

I want to call the non-static MyClass::SomeMethod() on an object instance. To do this I need to have the address of the object instance so I can pass it to the method as the implicit 'this' argument.

Is there a way to monitor the addresses of the created instances of MyClass?

Or is there some other way to call the SomeMethod() method of an already instantiated object?


I tried to simply record the 0th argument passed to the constructor with Frida (args[0]), but I couldn't access the this pointer, only the first "real" argument (passed explicitly by the caller).

I can think of two things:

  1. Frida doesn't care about the implicit this argument, or
  2. things are messed up because of the thiscall scheme used in Windows programs (I'm experimenting on 32-bit Windows). I couldn't figure out a way to get the value of ECX with Frida though...
  • @DCoder correct – buherator Feb 15 '14 at 14:55

First parameter of the constructor is the memory allocated for the object. (Usually stored at r0 for ARM and thumb). So the way to monitor it is simple: instrument all constructors of the class and watch the first constructor parameter.

| improve this answer | |
  • Thank you for your answer. Unfortunately it doesn't fit my problem, I'm updating my question with the details about why. – buherator Feb 20 '14 at 13:33

I was also struggling with this, until I realized that if the function uses a custom calling convention. args[n] assumes the default calling convention. For custom calling conventions, in this case __thiscall scheme, the pointer to this is on ecx register (accessible through this.context.ecx).

Hope this helps anyone!

| improve this answer | |

Your Answer

