C++虚表地址、虚函数地址打印

C++
#include <iostream>
using namespace std;

class Base
{
public :
    int base_data;
    Base() { base_data = 1; }
    virtual void func1() { cout << "base_func1" << endl; }
    virtual void func2() { cout << "base_func2" << endl; }
    virtual void func3() { cout << "base_func3" << endl; }
};

class Derive : public Base
{
public :
    int derive_data;
    Derive() { derive_data = 2; }
    virtual void func1() { cout << "derive_func1" << endl; }
    virtual void func2() { cout << "derive_func2" << endl; }
};

typedef void (*func)();

int main()
{
    Base base;
    cout << "&base: " << &base << endl;
    cout << "&base.base_data: " << &base.base_data << endl;
    cout << "----------------------------------------" << endl;

    Derive derive;
    cout << "&derive: " << &derive << endl;
    cout << "&derive.base_data: " << &derive.base_data << endl;
    cout << "&derive.derive_data: " << &derive.derive_data << endl;
    cout << "----------------------------------------" << endl;

    for(int i=0; i<3; i++)
    {
        // &base : base首地址
        // (unsigned long*)&base : base的首地址,vptr的地址
        // (*(unsigned long*)&base) : vptr的内容,即vtable的地址,指向第一个虚函数的slot的地址
        // (unsigned long*)(*(unsigned long*)&base) : vtable的地址,指向第一个虚函数的slot的地址
        // vtbl : 指向虚函数slot的地址
        // *vtbl : 虚函数的地址
        unsigned long* vtbl = (unsigned long*)(*(unsigned long*)&base) + i;
        cout << "slot address: " << vtbl << endl;
        cout << "func address: 0x" << hex << *vtbl << endl;
        func pfunc = (func)*(vtbl);
        pfunc();
        cout << endl;
    }
    cout << "----------------------------------------" << endl;

    for(int i=0; i<3; i++)
    {
        unsigned long* vtbl = (unsigned long*)(*(unsigned long*)&derive) + i;
        cout << "slot address: " << vtbl << endl;
        cout << "func address: 0x" << hex << *vtbl << endl;
        func pfunc = (func)*(vtbl);
        pfunc();
        cout << endl;
    }
    cout << "----------------------------------------" << endl;
    return 1;
}

64位系统一个ptr占8个字节,vptr是在第一个位置,在数据成员之前的。

输出结果

Bash
&base: 0x3fffc82b6d80
&base.base_data: 0x3fffc82b6d88
----------------------------------------
&derive: 0x3fffc82b6d70
&derive.base_data: 0x3fffc82b6d78
&derive.derive_data: 0x3fffc82b6d7c
----------------------------------------
slot address: 0x1001fc78
func address: 0x10001170
base_func1

slot address: 0x1001fc80
func address: 0x100011e0
base_func2

slot address: 0x1001fc88
func address: 0x10001250
base_func3

----------------------------------------
slot address: 0x1001fcb0
func address: 0x100012c0
derive_func1

slot address: 0x1001fcb8
func address: 0x10001330
derive_func2

slot address: 0x1001fcc0
func address: 0x10001250
base_func3

----------------------------------------

g++ -fdump-class-hierarchy test.cpp -c

Bash
Vtable for Base
Base::_ZTV4Base: 5u entries
0     (int (*)(...))0
8     (int (*)(...))(& _ZTI4Base)
16    (int (*)(...))Base::func1
24    (int (*)(...))Base::func2
32    (int (*)(...))Base::func3

Class Base
   size=16 align=8
   base size=12 base align=8
Base (0x0x3fff78d28b80) 0
    vptr=((& Base::_ZTV4Base) + 16u)

Vtable for Derive
Derive::_ZTV6Derive: 5u entries
0     (int (*)(...))0
8     (int (*)(...))(& _ZTI6Derive)
16    (int (*)(...))Derive::func1
24    (int (*)(...))Derive::func2
32    (int (*)(...))Base::func3

Class Derive
   size=16 align=8
   base size=16 base align=8
Derive (0x0x3fff78d16c10) 0
    vptr=((& Derive::_ZTV6Derive) + 16u)
  Base (0x0x3fff78d28be0) 0
      primary-for Derive (0x0x3fff78d16c10)

行13,可以看到对虚指令的设置

Text Only
vptr=((& Base::_ZTV4Base) + 16u)