如何查找 vtable 顺序，专门针对 directx答案

【问题标题】：How to find the vtable order, Specifically for directx如何查找 vtable 顺序，专门针对 directx
【发布时间】：2020-01-09 22:20:22
【问题描述】：

我一直在尝试为 direct2d 获得正确的 vtable 顺序，我认为我得到了正确的顺序，但除了前 3 个（IUnknown 继承）之外它一直没有工作，我想知道如何获得正确的vtable 顺序。

到目前为止我的 vtable

;ID2D1RenderTargetVtbl
ID2D1RenderTarget_QueryInterface                textequ     <qword ptr [rbx+0]>
ID2D1RenderTarget_AddRef                        textequ     <qword ptr [rbx+8]>
ID2D1RenderTarget_Release                       textequ     <qword ptr [rbx+16]>
ID2D1RenderTarget_GetFactory                    textequ     <qword ptr [rbx+24]>
ID2D1RenderTarget_BeginDraw                     textequ     <qword ptr [rbx+32]>
ID2D1RenderTarget_Clear                         textequ     <qword ptr [rbx+40]>
ID2D1RenderTarget_CreateBitmap                  textequ     <qword ptr [rbx+48]>
ID2D1RenderTarget_CreateBitmapBrush             textequ     <qword ptr [rbx+56]>
ID2D1RenderTarget_CreateBitmapFromWicBitmap     textequ     <qword ptr [rbx+64]>
ID2D1RenderTarget_CreateCompatibleRenderTarget  textequ     <qword ptr [rbx+72]>
ID2D1RenderTarget_CreateGradientStopCollection  textequ     <qword ptr [rbx+80]>
ID2D1RenderTarget_CreateLayer                   textequ     <qword ptr [rbx+88]>
ID2D1RenderTarget_CreateLinearGradientBrush     textequ     <qword ptr [rbx+96]>
ID2D1RenderTarget_CreateMesh                    textequ     <qword ptr [rbx+104]>
ID2D1RenderTarget_CreateRadialGradientBrush     textequ     <qword ptr [rbx+112]>
ID2D1RenderTarget_CreateSharedBitmap            textequ     <qword ptr [rbx+120]>
ID2D1RenderTarget_CreateSolidColorBrush         textequ     <qword ptr [rbx+128]>
ID2D1RenderTarget_DrawBitmap                    textequ     <qword ptr [rbx+136]>
ID2D1RenderTarget_DrawEllipse                   textequ     <qword ptr [rbx+144]>
ID2D1RenderTarget_DrawGeometry                  textequ     <qword ptr [rbx+152]>
ID2D1RenderTarget_DrawGlyphRun                  textequ     <qword ptr [rbx+160]>
ID2D1RenderTarget_DrawLine                      textequ     <qword ptr [rbx+168]>
ID2D1RenderTarget_DrawRectangle                 textequ     <qword ptr [rbx+176]>
ID2D1RenderTarget_DrawRoundedRectangle          textequ     <qword ptr [rbx+184]>
ID2D1RenderTarget_DrawText                      textequ     <qword ptr [rbx+192]>
ID2D1RenderTarget_DrawTextLayout                textequ     <qword ptr [rbx+200]>
ID2D1RenderTarget_EndDraw                       textequ     <qword ptr [rbx+208]>
ID2D1RenderTarget_FillEllipse                   textequ     <qword ptr [rbx+216]>
ID2D1RenderTarget_FillGeometry                  textequ     <qword ptr [rbx+224]>
ID2D1RenderTarget_FillMesh                      textequ     <qword ptr [rbx+232]>
ID2D1RenderTarget_FillOpacityMask               textequ     <qword ptr [rbx+240]>
ID2D1RenderTarget_FillRectangle                 textequ     <qword ptr [rbx+248]>
ID2D1RenderTarget_FillRoundedRectangle          textequ     <qword ptr [rbx+256]>
ID2D1RenderTarget_Flush                         textequ     <qword ptr [rbx+264]>
ID2D1RenderTarget_GetAntialiasMode              textequ     <qword ptr [rbx+272]>
ID2D1RenderTarget_GetDpi                        textequ     <qword ptr [rbx+280]>
ID2D1RenderTarget_GetMaximumBitmapSize          textequ     <qword ptr [rbx+288]>
ID2D1RenderTarget_GetPixelFormat                textequ     <qword ptr [rbx+296]>
ID2D1RenderTarget_GetPixelSize                  textequ     <qword ptr [rbx+304]>
ID2D1RenderTarget_GetSize                       textequ     <qword ptr [rbx+312]>
ID2D1RenderTarget_GetTags                       textequ     <qword ptr [rbx+320]>
ID2D1RenderTarget_GetTextAntialiasMode          textequ     <qword ptr [rbx+328]>
ID2D1RenderTarget_GetTextRenderingParams        textequ     <qword ptr [rbx+336]>
ID2D1RenderTarget_GetTransform                  textequ     <qword ptr [rbx+344]>
ID2D1RenderTarget_IsSupported                   textequ     <qword ptr [rbx+352]>
ID2D1RenderTarget_PopAxisAlignedClip            textequ     <qword ptr [rbx+360]>
ID2D1RenderTarget_PopLayer                      textequ     <qword ptr [rbx+368]>
ID2D1RenderTarget_PushAxisAlignedClip           textequ     <qword ptr [rbx+376]>
ID2D1RenderTarget_PushLayer                     textequ     <qword ptr [rbx+384]>
ID2D1RenderTarget_RestoreDrawingState           textequ     <qword ptr [rbx+392]>
ID2D1RenderTarget_SaveDrawingState              textequ     <qword ptr [rbx+400]>
ID2D1RenderTarget_SetAntialiasMode              textequ     <qword ptr [rbx+408]>
ID2D1RenderTarget_SetDpi                        textequ     <qword ptr [rbx+416]>
ID2D1RenderTarget_SetTags                       textequ     <qword ptr [rbx+424]>
ID2D1RenderTarget_SetTextAntialiasMode          textequ     <qword ptr [rbx+432]>
ID2D1RenderTarget_SetTextRenderingParams        textequ     <qword ptr [rbx+440]>
ID2D1RenderTarget_SetTransform                  textequ     <qword ptr [rbx+448]>
;ID2D1Factory
    ID2D1Factory_QueryInterface                 textequ     <qword ptr [rbx+0]>
    ID2D1Factory_AddRef                         textequ     <qword ptr [rbx+8]>
    ID2D1Factory_Release                        textequ     <qword ptr [rbx+16]>
    ID2D1Factory_CreateDCRenderTarget           textequ     <qword ptr [rbx+24]>
    ID2D1Factory_CreateDrawingStateBlock        textequ     <qword ptr [rbx+32]>
    ID2D1Factory_CreateDxgiSurfaceRenderTarget  textequ     <qword ptr [rbx+40]>
    ID2D1Factory_CreateEllipseGeometry          textequ     <qword ptr [rbx+48]>
    ID2D1Factory_CreateGeometryGroup            textequ     <qword ptr [rbx+56]>
    ID2D1Factory_CreateHwndRenderTarget         textequ     <qword ptr [rbx+64]>
    ID2D1Factory_CreatePathGeometry             textequ     <qword ptr [rbx+72]>
    ID2D1Factory_CreateRectangleGeometry        textequ     <qword ptr [rbx+80]>
    ID2D1Factory_CreateRoundedRectangleGeometry textequ     <qword ptr [rbx+88]>
    ID2D1Factory_CreateStrokeStyle              textequ     <qword ptr [rbx+96]>
    ID2D1Factory_CreateTransformedGeometry      textequ     <qword ptr [rbx+104]>
    ID2D1Factory_CreateWicBitmapRenderTarget    textequ     <qword ptr [rbx+112]>
    ID2D1Factory_GetDesktopDpi                  textequ     <qword ptr [rbx+120]>
    ID2D1Factory_ReloadSystemMetrics            textequ     <qword ptr [rbx+128]>
;dcrendertarget
    ID2D1DCRenderTarget_BeginDraw                       textequ     <qword ptr [rbx+24]>
    ID2D1DCRenderTarget_Clear                           textequ     <qword ptr [rbx+32]>
    ID2D1DCRenderTarget_CreateBitmap                    textequ     <qword ptr [rbx+40]>
    ID2D1DCRenderTarget_CreateBitmapBrush               textequ     <qword ptr [rbx+48]>
    ID2D1DCRenderTarget_CreateBitmapFromWicBitmap       textequ     <qword ptr [rbx+56]>
    ID2D1DCRenderTarget_CreateCompatibleRenderTarget    textequ     <qword ptr [rbx+64]>
    ID2D1DCRenderTarget_CreateGradientStopCollection    textequ     <qword ptr [rbx+72]>
    ID2D1DCRenderTarget_CreateLayer                     textequ     <qword ptr [rbx+80]>
    ID2D1DCRenderTarget_CreateLinearGradientBrush       textequ     <qword ptr [rbx+88]>
    ID2D1DCRenderTarget_CreateMesh                      textequ     <qword ptr [rbx+96]>
    ID2D1DCRenderTarget_CreateRadialGradientBrush       textequ     <qword ptr [rbx+104]>
    ID2D1DCRenderTarget_CreateSharedBitmap              textequ     <qword ptr [rbx+112]>
    ID2D1DCRenderTarget_CreateSolidColorBrush           textequ     <qword ptr [rbx+120]>
    ID2D1DCRenderTarget_DrawBitmap                      textequ     <qword ptr [rbx+128]>
    ID2D1DCRenderTarget_DrawEllipse                     textequ     <qword ptr [rbx+136]>
    ID2D1DCRenderTarget_DrawGeometry                    textequ     <qword ptr [rbx+144]>
    ID2D1DCRenderTarget_DrawGlyphRun                    textequ     <qword ptr [rbx+152]>
    ID2D1DCRenderTarget_DrawLine                        textequ     <qword ptr [rbx+160]>
    ID2D1DCRenderTarget_DrawRectangle                   textequ     <qword ptr [rbx+168]>
    ID2D1DCRenderTarget_DrawRoundedRectangle            textequ     <qword ptr [rbx+176]>
    ID2D1DCRenderTarget_DrawText                        textequ     <qword ptr [rbx+184]>
    ID2D1DCRenderTarget_DrawTextLayout                  textequ     <qword ptr [rbx+192]>
    ID2D1DCRenderTarget_EndDraw                         textequ     <qword ptr [rbx+200]>
    ID2D1DCRenderTarget_FillEllipse                     textequ     <qword ptr [rbx+208]>
    ID2D1DCRenderTarget_FillGeometry                    textequ     <qword ptr [rbx+216]>
    ID2D1DCRenderTarget_FillMesh                        textequ     <qword ptr [rbx+224]>
    ID2D1DCRenderTarget_FillOpacityMask                 textequ     <qword ptr [rbx+232]>
    ID2D1DCRenderTarget_FillRectangle                   textequ     <qword ptr [rbx+240]>
    ID2D1DCRenderTarget_FillRoundedRectangle            textequ     <qword ptr [rbx+248]>
    ID2D1DCRenderTarget_Flush                           textequ     <qword ptr [rbx+256]>
    ID2D1DCRenderTarget_GetAntialiasMode                textequ     <qword ptr [rbx+264]>
    ID2D1DCRenderTarget_GetDpi                          textequ     <qword ptr [rbx+272]>
    ID2D1DCRenderTarget_GetMaximumBitmapSize            textequ     <qword ptr [rbx+280]>
    ID2D1DCRenderTarget_GetPixelFormat                  textequ     <qword ptr [rbx+288]>
    ID2D1DCRenderTarget_GetPixelSize                    textequ     <qword ptr [rbx+296]>
    ID2D1DCRenderTarget_GetSize                         textequ     <qword ptr [rbx+304]>
    ID2D1DCRenderTarget_GetTags                         textequ     <qword ptr [rbx+312]>
    ID2D1DCRenderTarget_GetTextAntialiasMode            textequ     <qword ptr [rbx+320]>
    ID2D1DCRenderTarget_GetTextRenderingParams          textequ     <qword ptr [rbx+328]>
    ID2D1DCRenderTarget_GetTransform                    textequ     <qword ptr [rbx+336]>
    ID2D1DCRenderTarget_IsSupported                     textequ     <qword ptr [rbx+344]>
    ID2D1DCRenderTarget_PopAxisAlignedClip              textequ     <qword ptr [rbx+352]>
    ID2D1DCRenderTarget_PopLayer                        textequ     <qword ptr [rbx+360]>
    ID2D1DCRenderTarget_PushAxisAlignedClip             textequ     <qword ptr [rbx+368]>
    ID2D1DCRenderTarget_PushLayer                       textequ     <qword ptr [rbx+376]>
    ID2D1DCRenderTarget_RestoreDrawingState             textequ     <qword ptr [rbx+384]>
    ID2D1DCRenderTarget_SaveDrawingState                textequ     <qword ptr [rbx+392]>
    ID2D1DCRenderTarget_SetAntialiasMode                textequ     <qword ptr [rbx+400]>
    ID2D1DCRenderTarget_SetDpi                          textequ     <qword ptr [rbx+408]>
    ID2D1DCRenderTarget_SetTags                         textequ     <qword ptr [rbx+416]>
    ID2D1DCRenderTarget_SetTextAntialiasMode            textequ     <qword ptr [rbx+424]>
    ID2D1DCRenderTarget_SetTextRenderingParams          textequ     <qword ptr [rbx+432]>
    ID2D1DCRenderTarget_SetTransform                    textequ     <qword ptr [rbx+440]>
    ID2D1DCRenderTarget_BindDC                          textequ     <qword ptr [rbx+448]>

我知道addref 可以工作，但我根本没有让CreateDCRenderTarget 工作

我如何获得这些的来源可以在这里找到VTable，但现在我怀疑它是否真的有效

因此，如果有人知道如何获得正确的 VTable 顺序，那就太棒了。

【问题讨论】：

为什么要硬编码寻址模式作为以 RBX 为基础的文本替换？您可以只定义数字偏移的符号，您可以使用任何方便的寄存器来保存从对象加载的 vtable 指针。
一切都减1了吗？我想知道，因为 ID2D1RenderTarget 派生自 ID2D1Resource，而 ID2D1Resource 只有 1 个方法（IUnknown 除外）。
如前所述，ID2D1RenderTarget 派生自 ID2D1Resource。后者在偏移量 24 处引入了 GetFactory 方法。因此，CreateBitmap 位于偏移量 32 处（假设是 64 位构建）。
我修复了 ID2D1RenderTarget vtable 顺序。

标签： winapi assembly directx x86-64 abi

【解决方案1】：

vtable 的顺序错误。取自DirectXVtable，它定义了 Vtable，然后再次定义它，但顺序错误。

#define INTERFACE ID2D1Factory
DECLARE_INTERFACE_(ID2D1Factory, IUnknown)
{
  BEGIN_INTERFACE

  /* IUnknown methods */
  STDMETHOD(QueryInterface)(THIS_ REFIID riid, void **ppvObject) PURE;
  STDMETHOD_(ULONG, AddRef)(THIS) PURE;
  STDMETHOD_(ULONG, Release)(THIS) PURE;

  /* ID2D1Factory methods */
  STDMETHOD(ReloadSystemMetrics)(THIS) PURE;
  STDMETHOD_(void, GetDesktopDpi)(THIS_ FLOAT *dpiX, FLOAT *dpiY) PURE;
  STDMETHOD(CreateRectangleGeometry)(THIS_ D2D1_RECT_F *rectangle, ID2D1RectangleGeometry **rectangleGeometry) PURE;
  STDMETHOD(CreateRoundedRectangleGeometry)(THIS_ D2D1_ROUNDED_RECT *roundedRectangle, ID2D1RoundedRectangleGeometry **roundedRectangleGeometry) PURE;
  STDMETHOD(CreateEllipseGeometry)(THIS_ D2D1_ELLIPSE *ellipse, ID2D1EllipseGeometry **ellipseGeometry) PURE;
  STDMETHOD(CreateGeometryGroup)(THIS_ D2D1_FILL_MODE fillMode, ID2D1Geometry **geometries, UINT geometriesCount, ID2D1GeometryGroup **geometryGroup) PURE;
  STDMETHOD(CreateTransformedGeometry)(THIS_ ID2D1Geometry *sourceGeometry, D2D1_MATRIX_3X2_F *transform, ID2D1TransformedGeometry **transformedGeometry) PURE;
  STDMETHOD(CreatePathGeometry)(THIS_ ID2D1PathGeometry **pathGeometry) PURE;
  STDMETHOD(CreateStrokeStyle)(THIS_ D2D1_STROKE_STYLE_PROPERTIES *strokeStyleProperties, FLOAT *dashes, UINT dashesCount, ID2D1StrokeStyle **strokeStyle) PURE;
  STDMETHOD(CreateDrawingStateBlock)(THIS_ D2D1_DRAWING_STATE_DESCRIPTION *drawingStateDescription, IDWriteRenderingParams *textRenderingParams, ID2D1DrawingStateBlock **drawingStateBlock) PURE;
  STDMETHOD(CreateWicBitmapRenderTarget)(THIS_ IWICBitmap *target, D2D1_RENDER_TARGET_PROPERTIES *renderTargetProperties, ID2D1RenderTarget **renderTarget) PURE;
  STDMETHOD(CreateHwndRenderTarget)(THIS_ D2D1_RENDER_TARGET_PROPERTIES *renderTargetProperties, D2D1_HWND_RENDER_TARGET_PROPERTIES *hwndRenderTargetProperties, ID2D1HwndRenderTarget **hwndRenderTarget) PURE;
  STDMETHOD(CreateDxgiSurfaceRenderTarget)(THIS_ IDXGISurface *dxgiSurface, D2D1_RENDER_TARGET_PROPERTIES *renderTargetProperties, ID2D1RenderTarget **renderTarget) PURE;
  STDMETHOD(CreateDCRenderTarget)(THIS_ D2D1_RENDER_TARGET_PROPERTIES *renderTargetProperties, ID2D1DCRenderTarget **dcRenderTarget) PURE;

  END_INTERFACE
};
#undef INTERFACE

#define ID2D1Factory_QueryInterface(this,A,B) (this)->lpVtbl->QueryInterface(this,A,B)
#define ID2D1Factory_AddRef(this) (this)->lpVtbl->AddRef(this)
#define ID2D1Factory_Release(this) (this)->lpVtbl->Release(this)
#define ID2D1Factory_CreateDCRenderTarget(this,A,B) (this)->lpVtbl->CreateDCRenderTarget(this,A,B)
#define ID2D1Factory_CreateDrawingStateBlock(this,A,B,C) (this)->lpVtbl->CreateDrawingStateBlock(this,A,B,C)
#define ID2D1Factory_CreateDxgiSurfaceRenderTarget(this,A,B,C) (this)->lpVtbl->CreateDxgiSurfaceRenderTarget(this,A,B,C)
#define ID2D1Factory_CreateEllipseGeometry(this,A,B) (this)->lpVtbl->CreateEllipseGeometry(this,A,B)
#define ID2D1Factory_CreateGeometryGroup(this,A,B,C,D) (this)->lpVtbl->CreateGeometryGroup(this,A,B,C,D)
#define ID2D1Factory_CreateHwndRenderTarget(this,A,B,C) (this)->lpVtbl->CreateHwndRenderTarget(this,A,B,C)
#define ID2D1Factory_CreatePathGeometry(this,A) (this)->lpVtbl->CreatePathGeometry(this,A)
#define ID2D1Factory_CreateRectangleGeometry(this,A,B) (this)->lpVtbl->CreateRectangleGeometry(this,A,B)
#define ID2D1Factory_CreateRoundedRectangleGeometry(this,A,B) (this)->lpVtbl->CreateRoundedRectangleGeometry(this,A,B)
#define ID2D1Factory_CreateStrokeStyle(this,A,B,C,D) (this)->lpVtbl->CreateStrokeStyle(this,A,B,C,D)
#define ID2D1Factory_CreateTransformedGeometry(this,A,B,C) (this)->lpVtbl->CreateTransformedGeometry(this,A,B,C)
#define ID2D1Factory_CreateWicBitmapRenderTarget(this,A,B,C) (this)->lpVtbl->CreateWicBitmapRenderTarget(this,A,B,C)
#define ID2D1Factory_GetDesktopDpi(this,A,B) (this)->lpVtbl->GetDesktopDpi(this,A,B)
#define ID2D1Factory_ReloadSystemMetrics(this) (this)->lpVtbl->ReloadSystemMetrics(this)

您查看的是定义的“STDMETHOD”部分，而不是“#define”部分。

【讨论】：