Introduction
Half of the text of this article comes from my larger paper "Dynamic C++ Proposal". I decided that it would be useful to take the part about Qt internals, put it into another article, and extend it by adding a reversing part. Because of its nature, this is not the usual kind of article I write. In fact, I wrote the reversing part in less than a day. So, this is a very easy one. However, I think it is useful for people who need to reverse a Qt application and certainly wouldn't consider reading my other paper about Dynamic C++, which doesn't sound like a paper about Qt and, in fact, isn't a paper about Qt: the paragraph about Qt is only one among many others. Moreover, I haven't seen serious articles about this subject.
The first thing which needs to be considered when reversing Qt applications is what Qt brought to the C++ language. Events (inside the Qt framework) are just virtual functions, so nothing new there. This is not a C++ reversing guide. What is new in Qt are signals and slots, which rely on the dynamism of the Qt framework.
So, the first thing I'm going to show is how this dynamism works. The second part focuses on the reversing and, at that point, I will show how to obtain all the metadata we need when disassembling a "Q_OBJECT
" class.
Internals
The only serious C++ framework I've seen around is the Qt framework. Qt brought C++ to a new level. While the signals and slots technology introduced by Qt is very original, what really was interesting in the whole idea was that an object could call other object methods regardless of the object declaration. In order for signals and slots to work, dynamism was brought into C++. Well, of course, when using only signals and slots, the developer doesn't directly notice this behavior, it's all handled by the framework. However, this dynamism can be used by the developer through the QMetaObject
class as well.
I'm not going to explain the basics of signals and slots. The reader might check out the Qt documentation page. What I will do is to briefly show the internal workings of Qt dynamism. The current version of the Qt framework at the time I'm writing this paper is 4.4.3.
Let's consider a simple signals and slots example:
#include <QObject>
class Counter : public QObject
{
Q_OBJECT
public:
Counter() { m_value = 0; };
int value() const { return m_value; };
public slots:
void setValue(int value)
{
if (value != m_value)
{
m_value = value;
emit valueChanged(value);
}
};
signals:
void valueChanged(int newValue);
private:
int m_value;
};
#include "sas.h"
int main(int argc, char *argv[])
{
Counter a, b;
QObject::connect(&a, SIGNAL(valueChanged(int)),
&b, SLOT(setValue(int)));
a.setValue(12); b.setValue(48); return 0;
}
The SIGNAL
and SLOT
macros enclose their content in brackets, making it a string. Well, they do one more thing. They put an identification number in the string:
#define SLOT(a) "1"#a
#define SIGNAL(a) "2"#a
So, one might as well write:
QObject::connect(&a, "2valueChanged(int)", &b, "1setValue(int)");
The Qt keywords "signals
" and "slots
", which can be found in the class header, are only useful to the Qt metacompiler (the moc).
# if defined(QT_NO_KEYWORDS)
# define QT_NO_EMIT
# else
# define slots
# define signals protected
# endif
# define Q_SLOTS
# define Q_SIGNALS protected
# define Q_PRIVATE_SLOT(d, signature)
# define Q_EMIT
#ifndef QT_NO_EMIT
# define emit
#endif
In fact, as you can see, even the emit
macro just increases readability. Only the "signals
" macro is a bit different, because it qualifies Qt signals as protected methods, whereas slots can be of any kind. The first interesting part is the "Q_OBJECT
" macro:
#define Q_OBJECT_CHECK \
template <typename T> inline
void qt_check_for_QOBJECT_macro(const T &_q_argument)
const \
{ int i = qYouForgotTheQ_OBJECT_Macro(this, &_q_argument); i = i; }
template <typename T>
inline int qYouForgotTheQ_OBJECT_Macro(T, T) { return 0; }
template <typename T1, typename T2>
inline void qYouForgotTheQ_OBJECT_Macro(T1, T2) {}
#endif // QT_NO_MEMBER_TEMPLATES
#define Q_OBJECT \
public: \
Q_OBJECT_CHECK \
static const QMetaObject staticMetaObject; \
virtual const QMetaObject *metaObject() const; \
virtual void *qt_metacast(const char *); \
QT_TR_FUNCTIONS \
virtual int qt_metacall(QMetaObject::Call, int, void **); \
private:
staticMetaObject
is the QMetaObject
, which is static because, being the metadata class, it's shared by all instances of the same class. The metaObject
method just returns staticMetaObject
. QT_TR_FUNCTIONS
is a macro that defines all the "tr" functions used for multi-language support. qt_metacast
performs a dynamic cast, given the class name or the name of one of its base classes (Qt doesn't rely on RTTI, obviously). qt_metacall
calls an internal signal or slot by its index. Before I'm going to discuss the code generated by the moc, here's the QMetaObject
declaration:
struct Q_CORE_EXPORT QMetaObject
{
const char *className() const;
const QMetaObject *superClass() const;
QObject *cast(QObject *obj) const;
#ifndef QT_NO_TRANSLATION
QString tr(const char *s, const char *c) const;
QString trUtf8(const char *s, const char *c) const;
QString tr(const char *s, const char *c, int n) const;
QString trUtf8(const char *s, const char *c, int n) const;
#endif // QT_NO_TRANSLATION
int methodOffset() const;
int enumeratorOffset() const;
int propertyOffset() const;
int classInfoOffset() const;
int methodCount() const;
int enumeratorCount() const;
int propertyCount() const;
int classInfoCount() const;
int indexOfMethod(const char *method) const;
int indexOfSignal(const char *signal) const;
int indexOfSlot(const char *slot) const;
int indexOfEnumerator(const char *name) const;
int indexOfProperty(const char *name) const;
int indexOfClassInfo(const char *name) const;
QMetaMethod method(int index) const;
QMetaEnum enumerator(int index) const;
QMetaProperty property(int index) const;
QMetaClassInfo classInfo(int index) const;
QMetaProperty userProperty() const;
static bool checkConnectArgs(const char *signal, const char *method);
static QByteArray normalizedSignature(const char *method);
static QByteArray normalizedType(const char *type);
static bool connect(const QObject *sender, int signal_index,
const QObject *receiver, int method_index,
int type = 0, int *types = 0);
static bool disconnect(const QObject *sender, int signal_index,
const QObject *receiver, int method_index);
static void connectSlotsByName(QObject *o);
static void activate(QObject *sender, int signal_index, void **argv);
static void activate(QObject *sender, int from_signal_index,
int to_signal_index, void **argv);
static void activate(QObject *sender, const QMetaObject *,
int local_signal_index, void **argv);
static void activate(QObject *sender, const QMetaObject *,
int from_local_signal_index,
int to_local_signal_index, void
**argv);
static void addGuard(QObject **ptr);
static void removeGuard(QObject **ptr);
static void changeGuard(QObject **ptr, QObject *o);
static bool invokeMethod(QObject *obj, const char *member,
Qt::ConnectionType,
QGenericReturnArgument ret,
QGenericArgument val0 = QGenericArgument(0),
QGenericArgument val1 = QGenericArgument(),
QGenericArgument val2 = QGenericArgument(),
QGenericArgument val3 = QGenericArgument(),
QGenericArgument val4 = QGenericArgument(),
QGenericArgument val5 = QGenericArgument(),
QGenericArgument val6 = QGenericArgument(),
QGenericArgument val7 = QGenericArgument(),
QGenericArgument val8 = QGenericArgument(),
QGenericArgument val9 = QGenericArgument());
enum Call {
InvokeMetaMethod,
ReadProperty,
WriteProperty,
ResetProperty,
QueryPropertyDesignable,
QueryPropertyScriptable,
QueryPropertyStored,
QueryPropertyEditable,
QueryPropertyUser
};
#ifdef QT3_SUPPORT
QT3_SUPPORT const char *superClassName() const;
#endif
struct { const QMetaObject *superdata;
const char *stringdata;
const uint *data;
const QMetaObject **extradata;
} d;
};
The important part of QMetaObject
is the internal "d
" struct. The first member of this struct is a QMetaObject
class pointer. This member points to the parent Qt object metadata class. A class like ours can inherit from more than just one class, but it can have only one QObject
(or from it derived) base class, and that's the super class. Moreover, the moc relies on the fact that in a QObject
derived class declaration, the first inherited class is a QObject
(or derived) base class. Let's take a Qt dialog, which often uses multiple inheritance in its implementation:
class ConvDialog : public QDialog, private Ui::ConvDialog
{
Q_OBJECT
Which makes the moc produce this code:
const QMetaObject ConvDialog::staticMetaObject = {
{ &QDialog::staticMetaObject, qt_meta_stringdata_ConvDialog,
qt_meta_data_ConvDialog, 0 }
};
But, if ConvDialog
inherits Ui::ConvDialog
before QDialog
, the moc generates:
const QMetaObject ConvDialog::staticMetaObject = {
{ &Ui::ConvDialog::staticMetaObject, qt_meta_stringdata_ConvDialog,
qt_meta_data_ConvDialog, 0 }
};
Which is wrong, because Ui::ConvDialog
is not a derived class of QObject
, and thus hasn't got a staticMetaObject
member. Doing so will result in a compiling error.
The second member of the "d
" struct is a char
array, which contains the literal metadata of the class. The third member is an unsigned int array. This array is a table, and it contains all the metadata offsets, flags etc. So, if we want to enumerate the slots and signals of a class, we would have to go through this table and get the right offsets to obtain the method names from the stringdata
array. The fourth member is a null terminated array of QMetaObject
classes. This member provides storage for metadata information for additional classes. I've never seen it used, but it is referenced by the QMetaObject_findMetaObject
function.
static const QMetaObject *QMetaObject_findMetaObject(const QMetaObject *self,
const char *name)
{
while (self) {
if (strcmp(self->d.stringdata, name) == 0)
return self;
if (self->d.extradata) {
const QMetaObject **e = self->d.extradata;
while (*e) {
if (const QMetaObject *m =
QMetaObject_findMetaObject((*e), name))
return m;
++e;
}
}
self = self->d.superdata;
}
return self;
}
This function gets called only by the "property
" method, which, in turn, gets called by propertyCount
, propertyOffset
, and indexOfProperty
.
And, here's the moc generated code for our Counter
class:
#include "../sas.h"
#if !defined(Q_MOC_OUTPUT_REVISION)
#error "The header file 'sas.h' doesn't include <QObject>."
#elif Q_MOC_OUTPUT_REVISION != 59
#error "This file was generated using the moc from 4.4.3. It"
#error "cannot be used with the include files from this version of Qt."
#error "(The moc has changed too much.)"
#endif
QT_BEGIN_MOC_NAMESPACE
static const uint qt_meta_data_Counter[] = {
1, 0, 0, 0, 2, 10, 0, 0, 0, 0,
18, 9, 8, 8, 0x05,
42, 36, 8, 8, 0x0a,
0 };
static const char qt_meta_stringdata_Counter[] = {
"Counter\0\0newValue\0valueChanged(int)\0"
"value\0setValue(int)\0"
};
const QMetaObject Counter::staticMetaObject = {
{ &QObject::staticMetaObject, qt_meta_stringdata_Counter,
qt_meta_data_Counter, 0 }
};
const QMetaObject *Counter::metaObject() const
{
return &staticMetaObject;
}
void *Counter::qt_metacast(const char *_clname)
{
if (!_clname) return 0;
if (!strcmp(_clname, qt_meta_stringdata_Counter))
return static_cast<void*>(const_cast< Counter*>(this));
return QObject::qt_metacast(_clname);
}
int Counter::qt_metacall(QMetaObject::Call _c, int _id, void **_a)
{
_id = QObject::qt_metacall(_c, _id, _a);
if (_id < 0)
return _id;
if (_c == QMetaObject::InvokeMetaMethod) {
switch (_id) {
case 0: valueChanged((*reinterpret_cast< int(*)>(_a[1]))); break;
case 1: setValue((*reinterpret_cast< int(*)>(_a[1]))); break;
}
_id -= 2;
}
return _id;
}
void Counter::valueChanged(int _t1)
{
void *_a[] = { 0, const_cast<void*>(reinterpret_cast<const void>(&_t1)) };
QMetaObject::activate(this, &staticMetaObject, 0, _a);
}
QT_END_MOC_NAMESPACE
The qt_metacall
method calls other internal methods of the class by their index. Qt dynamism relies on indexes, avoiding pointers. The job of actually calling the methods is left to the compiler. This implementation makes the signals and slots mechanism quite fast.
Arguments are passed through a pointer to pointer array, and casted appropriately when calling the method. Using pointers, of course, is the only way to put all kinds of types in an array. Arguments start from position 1, because position 0 is reserved for the data to return. The signals and slots in the example are declared void
and, thus, have no data to return. If a slot had data to return, the code contained in the switch
would look like this:
if (_c == QMetaObject::InvokeMetaMethod) {
switch (_id) {
case 0: valueChanged((*reinterpret_cast< int(*)>(_a[1]))); break;
case 1: setValue((*reinterpret_cast< int(*)>(_a[1]))); break;
case 2: { int _r = exampleMethod((*reinterpret_cast< int(*)>(_a[1])));
if (_a[0]) *reinterpret_cast< int*>(_a[0]) = _r; } break;
}
The other interesting method generated by the moc is valueChanged
, which represents the code executed to emit the "valueChanged
" signal. This code calls QMetaObject
's Activate
method, which is just an overload of this Activate
method:
void QMetaObject::activate(QObject *sender, int from_signal_index,
int to_signal_index, void **argv)
{
for (int signal = from_signal_index;
(signal >= from_signal_index &&
signal <= to_signal_index) || (signal == -2);
(signal == to_signal_index ? signal = -2 : ++signal))
{
if (signal >= connectionLists->count()) {
signal = to_signal_index;
continue;
}
const QObjectPrivate::ConnectionList &connectionList =
connectionLists->at(signal);
int count = connectionList.count();
for (int i = 0; i < count; ++i) {
const QObjectPrivate::Connection *c = &connectionList[i];
if (!c->receiver)
continue;
QObject * const receiver = c->receiver;
if ((c->connectionType == Qt::AutoConnection
&& (currentThreadData != sender->d_func()->threadData
|| receiver->d_func()->threadData !=
sender->d_func()->threadData))
|| (c->connectionType == Qt::QueuedConnection)) {
queued_activate(sender, signal, *c, argv);
continue;
} else if (c->connectionType == Qt::BlockingQueuedConnection) {
blocking_activate(sender, signal, *c, argv);
continue;
}
const int method = c->method;
QObjectPrivate::Sender currentSender;
currentSender.sender = sender;
currentSender.signal = signal < 0 ? from_signal_index : signal;
QObjectPrivate::Sender * const previousSender =
QObjectPrivate::setCurrentSender(receiver, ¤tSender);
locker.unlock();
if (qt_signal_spy_callback_set.slot_begin_callback != 0) {
qt_signal_spy_callback_set.slot_begin_callback(receiver,
method,
argv ? argv : empty_argv);
}
#if defined(QT_NO_EXCEPTIONS)
receiver->qt_metacall(QMetaObject::InvokeMetaMethod,
method, argv ? argv : empty_argv);
#else
try {
receiver->qt_metacall(QMetaObject::InvokeMetaMethod,
method, argv ? argv : empty_argv);
} catch (...) {
locker.relock();
QObjectPrivate::resetCurrentSender(receiver,
¤tSender, previousSender);
--connectionLists->inUse;
Q_ASSERT(connectionLists->inUse >= 0);
if (connectionLists->orphaned && !connectionLists->inUse)
delete connectionLists;
throw;
}
#endif
locker.relock();
if (qt_signal_spy_callback_set.slot_end_callback != 0)
qt_signal_spy_callback_set.slot_end_callback(receiver, method);
QObjectPrivate::resetCurrentSender(receiver,
¤tSender, previousSender);
if (connectionLists->orphaned)
break;
}
if (connectionLists->orphaned)
break;
}
--connectionLists->inUse;
Q_ASSERT(connectionLists->inUse >= 0);
if (connectionLists->orphaned && !connectionLists->inUse)
delete connectionLists;
locker.unlock();
if (qt_signal_spy_callback_set.signal_end_callback != 0)
qt_signal_spy_callback_set.signal_end_callback(sender,
from_signal_index);
}
This method does lots of stuff, including checking whether the current connection should be processed immediately or put into the event queue. If so, it calls the appropriate Activate
method variant, and then continues with the next connection in the ConnectionList
. Otherwise, if the connection should be processed immediately, the ID of the method to call is retrieved from the current connection, and the qt_metacall
method of the receiver gets called. To simplify the execution flow:
const QObjectPrivate::ConnectionList &connectionList = connectionLists->at(signal);
int count = connectionList.count();
for (int i = 0; i < count; ++i) {
const QObjectPrivate::Connection *c = &connectionList[i];
QObject * const receiver = c->receiver;
const int method = c->method;
receiver->qt_metacall(QMetaObject::InvokeMetaMethod, method,
argv ? argv : empty_argv);
And, this tells us all we need to know about the internals of signals and slots. When calling the "connect
" function, the signal and slot signatures are converted to their IDs, which are then stored in the Connection
class. Every time a signal is emitted, the connections for the signal's ID are retrieved and their slots are called by their IDs.
The last part which needs to be discussed are dynamic invokes. The QMetaObject
class offers the invokeMethod
method to dynamically call a method. This method is a bit different than signals and slots, because it needs to build a signature for the method to call, from its return type, name and argument types, and then look up the metadata to retrieve its ID, before calling the qt_metacall
method of the object.
bool QMetaObject::invokeMethod(QObject *obj,
const char *member, Qt::ConnectionType type,
QGenericReturnArgument ret,
QGenericArgument val0,
QGenericArgument val1,
QGenericArgument val2,
QGenericArgument val3,
QGenericArgument val4,
QGenericArgument val5,
QGenericArgument val6,
QGenericArgument val7,
QGenericArgument val8,
QGenericArgument val9)
{
if (!obj)
return false;
QVarLengthArray<char, 512> sig;
int len = qstrlen(member);
if (len <= 0)
return false;
sig.append(member, len);
sig.append('(');
enum { MaximumParamCount = 11 };
const char *typeNames[] = {ret.name(), val0.name(), val1.name(),
val2.name(), val3.name(),
val4.name(), val5.name(), val6.name(),
val7.name(), val8.name(), val9.name()};
int paramCount;
for (paramCount = 1; paramCount < MaximumParamCount; ++paramCount) {
len = qstrlen(typeNames[paramCount]);
if (len <= 0)
break;
sig.append(typeNames[paramCount], len);
sig.append(',');
}
if (paramCount == 1)
sig.append(')'); else
sig[sig.size() - 1] = ')';
sig.append('\0');
int idx = obj->metaObject()->indexOfMethod(sig.constData());
if (idx < 0) {
QByteArray norm = QMetaObject::normalizedSignature(sig.constData());
idx = obj->metaObject()->indexOfMethod(norm.constData());
}
if (idx < 0)
return false;
if (ret.data()) {
const char *retType = obj->metaObject()->method(idx).typeName();
if (qstrcmp(ret.name(), retType) != 0) {
QByteArray unnormalized;
int len = qstrlen(ret.name());
unnormalized.reserve(len + 3);
unnormalized = "_("; unnormalized.append(ret.name());
unnormalized.append(')');
QByteArray normalized =
QMetaObject::normalizedSignature(unnormalized.constData());
normalized.truncate(normalized.length() - 1);
if (qstrcmp(normalized.constData() + 2, retType) != 0)
return false;
}
}
void *param[] = {ret.data(), val0.data(), val1.data(), val2.data(),
val3.data(), val4.data(),
val5.data(), val6.data(), val7.data(),
val8.data(), val9.data()};
if (type == Qt::AutoConnection) {
type = QThread::currentThread() == obj->thread()
? Qt::DirectConnection
: Qt::QueuedConnection;
}
if (type == Qt::DirectConnection) {
return obj->qt_metacall(QMetaObject::InvokeMetaMethod, idx, param) < 0;
} else {
if (ret.data()) {
qWarning("QMetaObject::invokeMethod: Unable to invoke"
" methods with return values in queued "
"connections");
return false;
}
int nargs = 1; void **args = (void **) qMalloc(paramCount * sizeof(void *));
int *types = (int *) qMalloc(paramCount * sizeof(int));
types[0] = 0; args[0] = 0;
for (int i = 1; i < paramCount; ++i) {
types[i] = QMetaType::type(typeNames[i]);
if (types[i]) {
args[i] = QMetaType::construct(types[i], param[i]);
++nargs;
} else if (param[i]) {
qWarning("QMetaObject::invokeMethod: Unable to handle"
" unregistered datatype '%s'",
typeNames[i]);
for (int x = 1; x < i; ++x) {
if (types[x] && args[x])
QMetaType::destroy(types[x], args[x]);
}
qFree(types);
qFree(args);
return false;
}
}
if (type == Qt::QueuedConnection) {
QCoreApplication::postEvent(obj,
new QMetaCallEvent(idx, 0, -1, nargs, types, args));
} else {
if (QThread::currentThread() == obj->thread()) {
qWarning("QMetaObject::invokeMethod: Dead lock detected"
" in BlockingQueuedConnection: "
"Receiver is %s(%p)",
obj->metaObject()->className(), obj);
}
#ifdef QT_NO_THREAD
QCoreApplication::postEvent(obj,
new QMetaCallEvent(idx, 0, -1, nargs, types, args));
#else
QSemaphore semaphore;
QCoreApplication::postEvent(obj, new QMetaCallEvent(idx, 0, -1,
nargs, types, args, &semaphore));
semaphore.acquire();
#endif // QT_NO_THREAD
}
}
return true;
}
The method ID is retrieved through indexOfMethod
. If the method signature can't be found, invokeMethod
returns false
.
And, this should give you a general idea about Qt internals.
Reversing
When reversing, we want to use all the metadata Qt offers. In order to do that, let's reconsider the metadata table:
QT_BEGIN_MOC_NAMESPACE
static const uint qt_meta_data_Counter[] = {
1, 0, 0, 0, 2, 10, 0, 0, 0, 0,
18, 9, 8, 8, 0x05,
42, 36, 8, 8, 0x0a,
0 };
As we can notice, the table tells us not only the method count, but also the offset of the methods (10). Here's the C++ declared header of this structure:
struct QMetaObjectPrivate
{
int revision;
int className;
int classInfoCount, classInfoData;
int methodCount, methodData;
int propertyCount, propertyData;
int enumeratorCount, enumeratorData;
};
This structure is contained in "qmetaobject.cpp"; like the rest of the information, we need to parse the metadata table. Before taking into account properties and enums, let's consider methods. We already have the method count and offset, what now has to be analyzed is the data of the methods itself. This data is subdivided into five integers, which represent, according to the moc: signature, parameters, type, tag, flags. The "signature" field is an offset into the string data, and refers a partial declaration (without return type) of the method: "valueChanged(int)
". The "parameters" field is another offset to the names of the arguments. Yes, the names: "newValue". The names are separated by commas, so if our slot has two arguments, it would display: "newValue1,newValue2". The "type" field refers to the return type of the method. If it's an empty string, like in our case, then the method is declared as "void
". The "tag" method is unused for the moment. I paste you the description found in the sources: "Tags are special macros recognized by moc that make it possible to add extra information about a method. For the moment, moc doesn't support any special tags." The last field "flags" is not an offset, but, as the name suggests, flags. Here's the list of possible flags:
enum MethodFlags {
AccessPrivate = 0x00,
AccessProtected = 0x01,
AccessPublic = 0x02,
AccessMask = 0x03,
MethodMethod = 0x00,
MethodSignal = 0x04,
MethodSlot = 0x08,
MethodTypeMask = 0x0c,
MethodCompatibility = 0x10,
MethodCloned = 0x20,
MethodScriptable = 0x40
};
This is all we need to know about methods. Let's now consider enums and properties. For this purpose, I added one of each to the code example above:
class Counter : public QObject
{
Q_OBJECT
Q_PROPERTY(Priority priority READ priority WRITE setPriority)
Q_ENUMS(Priority)
public:
Counter() { m_value = 0; };
enum Priority { High, Low, VeryHigh, VeryLow };
void setPriority(Priority priority) { m_priority = priority; };
Priority priority() const { return m_priority; };
int value() const { return m_value; };
public slots:
void setValue(int value)
{
if (value != m_value)
{
m_value = value;
emit valueChanged(value);
}
};
signals:
void valueChanged(int newValue);
private:
int m_value;
Priority m_priority;
};
And the moc generates:
static const uint qt_meta_data_Counter[] = {
1, 0, 0, 0, 2, 10, 1, 20, 1, 23,
18, 9, 8, 8, 0x05,
42, 36, 8, 8, 0x0a,
65, 56, 0x0009510b,
56, 0x0, 4, 27,
74, uint(Counter::High),
79, uint(Counter::Low),
83, uint(Counter::VeryHigh),
92, uint(Counter::VeryLow),
0 };
static const char qt_meta_stringdata_Counter[] = {
"Counter\0\0newValue\0valueChanged(int)\0"
"value\0setValue(int)\0Priority\0priority\0"
"High\0Low\0VeryHigh\0VeryLow\0"
};
Again, we have the properties and enums count and their offsets. Let's start with properties. The data of properties is made of three integers: name, type, flags. The "name" field refers, of course, to the name. The "type" field refers to the type of the property, in our case: "Priority". Finally, the "flags" field contains flags, and here's the list:
enum PropertyFlags {
Invalid = 0x00000000,
Readable = 0x00000001,
Writable = 0x00000002,
Resettable = 0x00000004,
EnumOrFlag = 0x00000008,
StdCppSet = 0x00000100,
Designable = 0x00001000,
ResolveDesignable = 0x00002000,
Scriptable = 0x00004000,
ResolveScriptable = 0x00008000,
Stored = 0x00010000,
ResolveStored = 0x00020000,
Editable = 0x00040000,
ResolveEditable = 0x00080000,
User = 0x00100000,
ResolveUser = 0x00200000
};
Let's now consider the enum: name, flags, count, data. We already know what the "name" field is by now. The "flags" field isn't used. The "count" field represents the numbers of items contained in the enum. The "data" field is an offset into the metadata table, and points to the items of the enum. Every item is represented by two integers: key, value. The "key" field points to the name of the current item, whereas "value" is the actual value of the item.
In order to retrieve the metadata information from a binary file, I wrote a script for IDA. I wrote the script in Python, thanks to the IDAPython plug-in. Many reasons for using Python: writing the same code with IDC script would be way too much effort, and Python can be re-used even outside the IDA. The script extracts methods, properties, and enums from the layout of a "Q_OBJECT
" class. Here's the code:
b64bit = False
def AddressSize():
if b64bit == True:
return 8
return 4
def ReadAddress(addr):
if b64bit == True:
return (Dword(addr+4) << 32) | Dword(addr)
return Dword(addr)
class MetaParser:
def __init__(self, stringsaddr, tableaddr):
self.MetaStrings = stringsaddr
self.MetaTable = tableaddr
def ReadString(self, addr):
c = addr
b = Byte(c)
str = ""
while b != 0:
if (c - addr) > 1000:
return "error"
str += chr(b)
c += 1
b = Byte(c)
return str
"""
struct QMetaObjectPrivate
{
int revision;
int className;
int classInfoCount, classInfoData;
int methodCount, methodData;
int propertyCount, propertyData;
int enumeratorCount, enumeratorData;
};
"""
class Enum:
def __init__(self, **entries): self.__dict__.update(entries)
MethodFlags = Enum( \
AccessPrivate = 0x00, \
AccessProtected = 0x01, \
AccessPublic = 0x02, \
AccessMask = 0x03, \
MethodMethod = 0x00, \
MethodSignal = 0x04, \
MethodSlot = 0x08, \
MethodTypeMask = 0x0c, \
MethodCompatibility = 0x10, \
MethodCloned = 0x20, \
MethodScriptable = 0x40)
PropertyFlags = Enum( \
Invalid = 0x00000000, \
Readable = 0x00000001, \
Writable = 0x00000002, \
Resettable = 0x00000004, \
EnumOrFlag = 0x00000008, \
StdCppSet = 0x00000100, \
Designable = 0x00001000, \
ResolveDesignable = 0x00002000, \
Scriptable = 0x00004000, \
ResolveScriptable = 0x00008000, \
Stored = 0x00010000, \
ResolveStored = 0x00020000, \
Editable = 0x00040000, \
ResolveEditable = 0x00080000, \
User = 0x00100000, \
ResolveUser = 0x00200000)
def GetClassName(self):
stringaddr = Dword(self.MetaTable + 4) + self.MetaStrings
return self.ReadString(stringaddr)
def GetMethodNumber(self):
return Dword(self.MetaTable + 16)
def GetMethodSignature(self, method_index):
if method_index >= self.GetMethodNumber():
return "error: method index out of range"
method_offset = (Dword(self.MetaTable + 20) * 4) +
(method_index * (5 * 4))
access_flags = self.GetMethodAccess(method_index)
access_type = "private: "
if access_flags == self.MethodFlags.AccessProtected:
access_type = "protected: "
elif access_flags == self.MethodFlags.AccessPublic:
access_type = "public: "
rettype = self.ReadString(Dword(self.MetaTable + method_offset + 8) +
self.MetaStrings)
if rettype == "":
rettype = "void"
psign = self.ReadString(Dword(self.MetaTable + method_offset) +
self.MetaStrings)
par_index = psign.find("(")
arg_types = psign[(par_index + 1):(len(psign) - 1)].split(",")
arg_names = self.ReadString(Dword(self.MetaTable + method_offset + 4) \
+ self.MetaStrings).split(",")
if len(arg_types) != len(arg_names):
return access_type + rettype + " " + psign
ntypes = len(arg_types)
x = 0
args = ""
while x < ntypes:
if x != 0:
args += ", "
if arg_types[x] == "":
args += arg_names[x]
elif arg_names[x] == "":
args += arg_types[x]
else:
args += (arg_types[x] + " " + arg_names[x])
x += 1
return access_type + rettype + " " +
psign[0:(par_index + 1)] + args + ")"
def GetMethodFlags(self, method_index):
if method_index >= self.GetMethodNumber():
return -1
method_offset = (Dword(self.MetaTable + 20) * 4) +
(method_index * (5 * 4))
return Dword(self.MetaTable + method_offset + 16)
def GetMethodType(self, method_index):
return self.GetMethodFlags(method_index) &
self.MethodFlags.MethodTypeMask
def GetMethodAccess(self, method_index):
return self.GetMethodFlags(method_index) &
self.MethodFlags.AccessMask
def GetPropertyNumber(self):
return Dword(self.MetaTable + 24)
def GetPropertyDecl(self, property_index):
if property_index >= self.GetPropertyNumber():
return "error: property index out of range"
property_offset = (Dword(self.MetaTable + 28) * 4) +
(property_index * (3 * 4))
pr_name = self.ReadString(Dword(self.MetaTable + property_offset) +
self.MetaStrings)
pr_type = self.ReadString(Dword(self.MetaTable + property_offset + 4) +
self.MetaStrings)
return pr_type + " " + pr_name
def GetPropertyFlags(self, property_index):
if property_index >= self.GetPropertyNumber():
return -1
property_offset = (Dword(self.MetaTable + 28) * 4) +
(property_index * (3 * 4))
return Dword(self.MetaTable + property_offset + 8)
def PropertyFlagsToString(self, flags):
if flags == 0:
return "Invalid"
fstr = ""
if flags & self.PropertyFlags.Readable:
fstr += " | Readable"
if flags & self.PropertyFlags.Writable:
fstr += " | Writable"
if flags & self.PropertyFlags.Resettable:
fstr += " | Resettable"
if flags & self.PropertyFlags.EnumOrFlag:
fstr += " | EnumOrFlag"
if flags & self.PropertyFlags.StdCppSet:
fstr += " | StdCppSet"
if flags & self.PropertyFlags.Designable:
fstr += " | Designable"
if flags & self.PropertyFlags.ResolveDesignable:
fstr += " | ResolveDesignable"
if flags & self.PropertyFlags.Scriptable:
fstr += " | Scriptable"
if flags & self.PropertyFlags.ResolveScriptable:
fstr += " | ResolveScriptable"
if flags & self.PropertyFlags.Stored:
fstr += " | Stored"
if flags & self.PropertyFlags.ResolveStored:
fstr += " | ResolveStored"
if flags & self.PropertyFlags.Editable:
fstr += " | Editable"
if flags & self.PropertyFlags.ResolveEditable:
fstr += " | ResolveEditable"
if flags & self.PropertyFlags.User:
fstr += " | User"
if flags & self.PropertyFlags.ResolveUser:
fstr += " | ResolveUser"
return fstr[3:]
def GetEnumNumber(self):
return Dword(self.MetaTable + 32)
def GetEnumDecl(self, enum_index):
if enum_index >= self.GetPropertyNumber():
return "error: property index out of range"
enum_offset = (Dword(self.MetaTable + 36) * 4) + (enum_index * (4 * 4))
enum_name = self.ReadString(Dword(self.MetaTable + enum_offset) +
self.MetaStrings)
items_num = Dword(self.MetaTable + enum_offset + 8)
items_addr = (Dword(self.MetaTable + enum_offset + 12) * 4) +
self.MetaTable
decl = "enum " + enum_name + "\n{\n"
x = 0
while x < items_num:
item_name = self.ReadString(Dword(items_addr) + self.MetaStrings)
item_data = "0x%X" % Dword(items_addr + 4)
decl += " " + item_name + " = " + item_data + ",\n"
x += 1
items_addr += 8
decl += "\n};"
return decl
def DisplayMethod(parser, method_index):
print(str(method_index) + " - " + parser.GetMethodSignature(method_index))
def DisplayProperty(parser, property_index):
print(str(property_index) + " - " + parser.GetPropertyDecl(property_index))
flags = parser.GetPropertyFlags(property_index)
print(" flags: " + parser.PropertyFlagsToString(flags))
def DisplayEnum(parser, enum_index):
print("[" + str(enum_index) + "]\n" +
parser.GetEnumDecl(enum_index) + "\n")
def DisplayMetaData(stringsaddr, tableaddr):
parser = MetaParser(stringsaddr, tableaddr)
print("\n-------------------------------------------------")
print("--- " + "Qt MetaData Displayer by Daniel Pistelli")
print("--- " + "metadata of the class: " + parser.GetClassName() + "\n")
num_methods = parser.GetMethodNumber()
num_properties = parser.GetPropertyNumber()
num_enums = parser.GetEnumNumber()
print("--- Signals:\n")
x = 0
while x < num_methods:
if parser.GetMethodType(x) == parser.MethodFlags.MethodSignal:
DisplayMethod(parser, x)
x += 1
print("\n--- Slots:\n")
x = 0
while x < num_methods:
if parser.GetMethodType(x) == parser.MethodFlags.MethodSlot:
DisplayMethod(parser, x)
x += 1
print("\n--- Other Methods:\n")
x = 0
while x < num_methods:
if parser.GetMethodType(x) == parser.MethodFlags.MethodMethod:
DisplayMethod(parser, x)
x += 1
print("\n--- Properties:\n")
x = 0
while x < num_properties:
DisplayProperty(parser, x)
x += 1
print("\n--- Enums:\n")
x = 0
while x < num_enums:
DisplayEnum(parser, x)
x += 1
print("-------------------------------------------------\n")
addrtoparse = ScreenEA()
if addrtoparse != 0:
stringsaddr = ReadAddress(addrtoparse + AddressSize())
tableaddr = ReadAddress(addrtoparse + AddressSize() * 2)
if stringsaddr != 0 or tableaddr != 0:
DisplayMetaData(stringsaddr, tableaddr)
I'll explain how to reach the metadata of a class in a moment. The "DisplayMetaData
" function accepts two parameters: the metadata table address, and the metadata strings address. That's because sometimes it happens that the layout of a class is set at runtime, like this VC++ applications does:
.text:00401D60 sub_401D60 proc near
.text:00401D60 push ebp
.text:00401D61 mov ebp, esp
.text:00401D63 mov eax, ds:?staticMetaObject@QObject@@2UQMetaObject@@B
.text:00401D68 mov dword_403070, eax
.text:00401D6D mov dword_403074, offset Str2
.text:00401D77 mov dword_403078, offset unk_4021A8
.text:00401D81 mov dword_40307C, 0
.text:00401D8B pop ebp
.text:00401D8C retn
.text:00401D8C sub_401D60 endp
Sometimes, the layout is already set in the physical file:
.data:00406000 dd 0
.data:00406004 dd offset MetaStrings
.data:00406008 dd offset MetaTable
In that case, the script can be directly launched at the address of the "SuperData
" item, which is the first one of the "d
" struct inside "QMetaObject
". The output of the script for the above "Counter
" class is:
-------------------------------------------------
--- Qt MetaData Displayer by Daniel Pistelli
--- metadata of the class: Counter
--- Signals:
0 - protected: void valueChanged(int newValue)
--- Slots:
1 - public: void setValue(int value)
--- Other Methods:
--- Properties:
0 - Priority priority
flags: Readable | Writable | EnumOrFlag | StdCppSet | Designable |
Scriptable | Stored | ResolveEditable
--- Enums:
[0]
enum Priority
{
High = 0x0,
Low = 0x1,
VeryHigh = 0x2,
VeryLow = 0x3,
};
-------------------------------------------------
Nice, isn't it? The signatures of the methods contain even argument names (when available). To check the quality of the script, I tested it on the larger class "QWidget
" inside the module "QtGui4
". Here's the result:
-------------------------------------------------
--- Qt MetaData Displayer by Daniel Pistelli
--- metadata of the class: QWidget
--- Signals:
0 - protected: void customContextMenuRequested(QPoint pos)
--- Slots:
1 - public: void setEnabled(bool)
2 - public: void setDisabled(bool)
3 - public: void setWindowModified(bool)
4 - public: void setWindowTitle(QString)
5 - public: void setStyleSheet(QString styleSheet)
6 - public: void setFocus()
7 - public: void update()
8 - public: void repaint()
9 - public: void setVisible(bool visible)
10 - public: void setHidden(bool hidden)
11 - public: void show()
12 - public: void hide()
13 - public: void setShown(bool shown)
14 - public: void showMinimized()
15 - public: void showMaximized()
16 - public: void showFullScreen()
17 - public: void showNormal()
18 - public: bool close()
19 - public: void raise()
20 - public: void lower()
21 - protected: void updateMicroFocus()
22 - private: void _q_showIfNotHidden()
--- Other Methods:
--- Properties:
0 - bool modal
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
1 - Qt::WindowModality windowModality
flags: Readable | Writable | EnumOrFlag | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
2 - bool enabled
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
3 - QRect geometry
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
4 - QRect frameGeometry
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
5 - QRect normalGeometry
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
6 - int x
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
7 - int y
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
8 - QPoint pos
flags: Readable | Writable | Scriptable | ResolveEditable
9 - QSize frameSize
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
10 - QSize size
flags: Readable | Writable | Scriptable | ResolveEditable
11 - int width
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
12 - int height
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
13 - QRect rect
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
14 - QRect childrenRect
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
15 - QRegion childrenRegion
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
16 - QSizePolicy sizePolicy
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
17 - QSize minimumSize
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
18 - QSize maximumSize
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
19 - int minimumWidth
flags: Readable | Writable | StdCppSet | Scriptable | ResolveEditable
20 - int minimumHeight
flags: Readable | Writable | StdCppSet | Scriptable | ResolveEditable
21 - int maximumWidth
flags: Readable | Writable | StdCppSet | Scriptable | ResolveEditable
22 - int maximumHeight
flags: Readable | Writable | StdCppSet | Scriptable | ResolveEditable
23 - QSize sizeIncrement
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
24 - QSize baseSize
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
25 - QPalette palette
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
26 - QFont font
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
27 - QCursor cursor
flags: Readable | Writable | Resettable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
28 - bool mouseTracking
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
29 - bool isActiveWindow
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
30 - Qt::FocusPolicy focusPolicy
flags: Readable | Writable | EnumOrFlag | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
31 - bool focus
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
32 - Qt::ContextMenuPolicy contextMenuPolicy
flags: Readable | Writable | EnumOrFlag | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
33 - bool updatesEnabled
flags: Readable | Writable | StdCppSet | Scriptable | Stored | ResolveEditable
34 - bool visible
flags: Readable | Writable | StdCppSet | Scriptable | Stored | ResolveEditable
35 - bool minimized
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
36 - bool maximized
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
37 - bool fullScreen
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
38 - QSize sizeHint
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
39 - QSize minimumSizeHint
flags: Readable | Designable | Scriptable | Stored | ResolveEditable
40 - bool acceptDrops
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
41 - QString windowTitle
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
42 - QIcon windowIcon
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
43 - QString windowIconText
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
44 - double windowOpacity
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
45 - bool windowModified
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
46 - QString toolTip
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
47 - QString statusTip
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
48 - QString whatsThis
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
49 - QString accessibleName
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
50 - QString accessibleDescription
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
51 - Qt::LayoutDirection layoutDirection
flags: Readable | Writable | Resettable | EnumOrFlag | StdCppSet | Designable |
Scriptable | Stored | ResolveEditable
52 - bool autoFillBackground
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
53 - QString styleSheet
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
54 - QLocale locale
flags: Readable | Writable | Resettable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
55 - QString windowFilePath
flags: Readable | Writable | StdCppSet | Designable | Scriptable |
Stored | ResolveEditable
--- Enums:
-------------------------------------------------
The output is 100% right when compared against the "QWidget
" source code.
Now, I'll show you how to find the metadata of a class. Let's consider the allocation of the "Counter
" class:
.text:004012F2 mov eax, ds:_ZN7QObjectC2EPS_
.text:004012F7 mov [esp+88h+var_84], ecx
.text:004012FB mov [ebp+var_3C], 2
.text:00401302 call eax
.text:00401304 mov eax, [ebp+var_4C]
.text:00401307 mov dword ptr [eax], offset virtual_ptrs
The last instruction of the assembly above sets the vtable pointer. The vtable of the "Q_OBJECT
" class looks like this:
.rdata:00402158 off_402158 dd offset metaObject
.rdata:0040215C dd offset qt_metacast
.rdata:00402160 dd offset qt_metacall
The method "metaObject
" can be used to obtain the metadata tables:
.text:00401430 metaObject proc near
.text:00401430 push ebp
.text:00401431 mov eax, offset dword_406000
.text:00401436 mov ebp, esp
.text:00401438 pop ebp
.text:00401439 retn
.text:00401439 metaObject endp
"dword_406000
" refers to the class layout of QMetaObject
, which we need to execute the script.
The next step, after retrieving the metadata of a class, is linking method (and property) names to their actual disassembled code. The script prints the index of each method and property. To obtain a method address from an index, it is necessary to consider the "qt_metacall
" method generated by the moc:
int Counter::qt_metacall(QMetaObject::Call _c, int _id, void **_a)
{
_id = QObject::qt_metacall(_c, _id, _a);
if (_id < 0)
return _id;
if (_c == QMetaObject::InvokeMetaMethod) {
switch (_id) {
case 0: valueChanged((*reinterpret_cast< int(*)>(_a[1]))); break;
case 1: setValue((*reinterpret_cast< int(*)>(_a[1]))); break;
}
_id -= 2;
}
#ifndef QT_NO_PROPERTIES
else if (_c == QMetaObject::ReadProperty) {
void *_v = _a[0];
switch (_id) {
case 0: *reinterpret_cast< Priority*>(_v) = priority(); break;
}
_id -= 1;
} else if (_c == QMetaObject::WriteProperty) {
void *_v = _a[0];
switch (_id) {
case 0: setPriority(*reinterpret_cast< Priority*>(_v)); break;
}
_id -= 1;
} else if (_c == QMetaObject::ResetProperty) {
_id -= 1;
} else if (_c == QMetaObject::QueryPropertyDesignable) {
_id -= 1;
} else if (_c == QMetaObject::QueryPropertyScriptable) {
_id -= 1;
} else if (_c == QMetaObject::QueryPropertyStored) {
_id -= 1;
} else if (_c == QMetaObject::QueryPropertyEditable) {
_id -= 1;
} else if (_c == QMetaObject::QueryPropertyUser) {
_id -= 1;
}
#endif // QT_NO_PROPERTIES
return _id;
}
This method can solve both method names and property get/set method names.
The address of "qt_metacall
" is obtained from the vtable. Before analyzing the code of this method, it is necessary to take into account this enum:
enum Call {
InvokeMetaMethod, ReadProperty, WriteProperty, ResetProperty, QueryPropertyDesignable, QueryPropertyScriptable, QueryPropertyStored, QueryPropertyEditable, QueryPropertyUser };
Now, the disassembly:
.text:004014D0 qt_metacall proc near
.text:004014D0
.text:004014D0 var_28 = dword ptr -28h
.text:004014D0 var_24 = dword ptr -24h
.text:004014D0 var_20 = dword ptr -20h
.text:004014D0 var_1C = dword ptr -1Ch
.text:004014D0 var_10 = dword ptr -10h
.text:004014D0 var_C = dword ptr -0Ch
.text:004014D0 var_8 = dword ptr -8
.text:004014D0 var_4 = dword ptr -4
.text:004014D0 arg_0 = dword ptr 8
.text:004014D0 arg_4 = dword ptr 0Ch
.text:004014D0 arg_8 = dword ptr 10h
.text:004014D0 arg_C = dword ptr 14h
.text:004014D0
.text:004014D0 push ebp
.text:004014D1 mov ebp, esp
.text:004014D3 sub esp, 28h
.text:004014D6 mov [ebp+var_C], ebx
.text:004014D9 mov eax, [ebp+arg_0]
.text:004014DC mov ebx, [ebp+arg_8]
.text:004014DF mov [ebp+var_8], esi
.text:004014E2 mov esi, [ebp+arg_4]
.text:004014E5 mov [ebp+var_4], edi
.text:004014E8 mov edi, [ebp+arg_C]
.text:004014EB mov [ebp+var_10], eax
.text:004014EE mov [esp+28h+var_20], ebx
.text:004014F2 mov [esp+28h+var_1C], edi
.text:004014F6 mov [esp+28h+var_24], esi
.text:004014FA mov [esp+28h+var_28], eax
.text:004014FD call _ZN7QObject11qt_metacallEN11QMetaObject4CallEiPPv
.text:00401502 test eax, eax
.text:00401504 mov ebx, eax
.text:00401506 js short loc_40151C
.text:00401508 test esi, esi
.text:0040150A jnz short loc_401530
.text:0040150C test eax, eax
.text:0040150E jz loc_4015B8
.text:00401514 cmp eax, 1
.text:00401517 jz short loc_401590
If the esi
register isn't equal to 0, then it's an InvokeMetaMethod
call. The switch
is represented by the last instructions. Let's follow the "_id == 0
" case:
.text:004015B8 loc_4015B8:
.text:004015B8 mov eax, [edi+4]
.text:004015BB mov edx, [ebp+var_10]
.text:004015BE mov eax, [eax]
.text:004015C0 mov [esp+28h+var_28], edx
.text:004015C3 mov [esp+28h+var_24], eax
.text:004015C7 call sub_401490
So, we can now establish that "sub_401490
" really is the "valueChanged
" signal:
.text:00401490
.text:00401490 signal_valueChanged proc near
.text:00401490
.text:00401490 var_18 = dword ptr -18h
.text:00401490 var_14 = dword ptr -14h
.text:00401490 var_10 = dword ptr -10h
.text:00401490 var_C = dword ptr -0Ch
.text:00401490 var_8 = dword ptr -8
.text:00401490 var_4 = dword ptr -4
.text:00401490 this = dword ptr 8
.text:00401490 newValue = dword ptr 0Ch
.text:00401490
.text:00401490 push ebp
.text:00401491 xor ecx, ecx
.text:00401493 mov ebp, esp
.text:00401495 lea eax, [ebp+newValue]
.text:00401498 sub esp, 18h
.text:0040149B mov [ebp+var_8], 0
.text:004014A2 mov edx, offset dword_406000
.text:004014A7 mov [ebp+var_4], eax
.text:004014AA lea eax, [ebp+var_8]
.text:004014AD mov [esp+18h+var_C], eax
.text:004014B1 mov eax, [ebp+this]
.text:004014B4 mov [esp+18h+var_10], ecx
.text:004014B8 mov [esp+18h+var_14], edx
.text:004014BC mov [esp+18h+var_18], eax
.text:004014BF call ds:_ZN11QMetaObject8activateEP7QObjectPKS_iPPv
.text:004014C5 leave
.text:004014C6 retn
Now the method is understandable. The same approach can be used to solve the get/set method names of properties. Of course, for a large analysis on a file, a little parser for switch
blocks could be written and combined with the Qt MetaData Parser script in order to solve all the methods automatically. However, switch
blocks are deeply platform and compiler dependent: thus, that script needs to be modified frequently. Moreover, small methods are sometimes inlined inside the "qt_metacall
" method, this should be considered when writing such a script.
Conclusions
This article took me just one day, and I enjoyed writing it. Although it's an easy one, someone might find it useful, also because, in my opinion, the Qt framework will be used more and more by software developers.