Using class members as callback functions

• Download multithread.zip-7.57KB

Introduction

In computer science, a callback is executable code that is passed as an argument to other code. It allows a lower-level software layer to call a function defined in a higher-level layer.

Usually, the higher-level code starts by calling a function within the lower-level code passing to it a pointer or handle to another function. While the lower-level function executes, it may call the passed-in function any number of times to perform some subtask.

Some functions examples which use callbacks are:

• EnumWindows - Enumerates all top-level windows on the screen by passing the handle to each window, in turn, to an application-defined callback function. EnumWindows continues until the last top-level window is enumerated or the callback function returns FALSE.
• qsort() - implements a quick-sort algorithm to sort an array
• CreateThread() - Creates a thread to execute within the virtual address space of the calling process.

In the object oriented programming of C++, using C-style callback functions is not possible without some little hacks. The problem is that we can pass only static member functions in these places. But class functions have no implicit this pointer, so they are rather limited. What we want is to use a real member function as a callback.

The article describes how this can be achieved by using Thunk Objects.

How member functions of classes are called?

Member functions of classes use a different calling convention named thiscall. This convention operates much like __stdcall except that the "this" pointer (which is effectively a hidden argument) is stored in the ECX register.

When you call a member function the machine code will looks like these:

mov ECX, pThis
jmp offsetProcedure

The first instruction stores the pointer to the object in question in ECX register. The second will be the relative jump needed to arrive at the start of the function.

Our Thunk Object template

When we declare our thunk object we need to set the packing to 1 so we make sure that there are no alignment gaps.

#pragma pack(push, 1) template <class T> class CThunk { BYTE m_mov; // mov ecx, %pThis DWORD m_this; // BYTE m_jmp; // jmp func DWORD m_relproc; // relative jmp public: typedef void (T::*TMFP)(); void InitThunk(TMFP method, const T* pThis) { union {DWORD func;TMFP method;} addr; addr.method = (TMFP)method; m_mov = 0xB9; #pragma warning(disable:4311) m_this = (DWORD)pThis; m_jmp = 0xE9; m_relproc = addr.func - (DWORD)(this+1); #pragma warning(default:4311) FlushInstructionCache(GetCurrentProcess(), this, sizeof(*this)); } FARPROC GetThunk() const { _ASSERT(m_mov == 0xB9); return (FARPROC)this; } }; #pragma pack(pop)

The values for m_mov and m_jmp are constant. m_this is store the object pointer as it's value. m_relproc is a bit more complicated. The jmp instruction needs a relative value, so we need to calculate the distance from where the instruction pointer is now to where it needs to be, in bytes. This distance is saved in m_relproc.
Finally we call FlushInstructionCache. This flushes the instruction cache for the current process to ensure that no processor has a stale copy of the instructions we have just created on the heap.

Creating a CThread wrapper using our Thunk Object template

First of all we must extend our CThread class from CThunk :

class CThread : public CThunk<CThread>

 In our class constructor we must initialize our thunk.

CThread() : m_hThread(0),m_dwThreadID(0) { InitThunk((TMFP)ThreadProc, this); }

Where ThreadProc is our member function that we want to use as callback function.

DWORD ThreadProc(LPVOID) { return Run(); }

Our Start() function which will create the new thread is declared as follows:

bool Start() { m_hThread=::CreateThread(0, 0, (LPTHREAD_START_ROUTINE)GetThunk(), 0, 0, &m_dwThreadID); return (m_hThread!=0); }

If you want to see the complete implementation of CThread class you can download the attachment.

The application contained in the article attachment use CThread to display some numbers in a new thread for 3 seconds.

Do not try to run this piece of code on other architecture than x86 because it will not works.

License

This article, along with any associated source code and files, is licensed under The Intelliproject Open License (IPOL)

About the author