[apaprocki]

Yeah, the author made a point of noting "this" could be in a register or the stack, but that to me just says "C". The functions moving around wouldn't necessarily mean it is written by hand, though. There just needs to be some rules governing the system and we don't know what those rules are (yet).

I would just be very surprised if this is anything other than some convention developed on top of C.

[dfox]

Differing calling conventions can point to combination of hand crafted object system in C with some custom code generator with some high level input that produces machine code directly without C in between. When you generate machine code that does not directly interface with system libraries it is often useful to ignore platform ABI calling conventions and make up your own.

[stianan]

Perhaps they use some kind of right-to-left fastcall convention. Or maybe they are just unconventional, putting "this" at the end of the parameter list, hence ending up in different registers or the stack depending on the number of arguments?

[stianan]

I don't immediately see why it would be putting arbitrary data in front of the vtable unless it's done by a person. Do you have any ideas?

[apaprocki]

Perhaps if they posted more examples.. I could see it being useful to put the "data" before the vtable in certain types so that one could simply cast the type to get the value instead of having to call an accessor function. A string type could have the char* as the first member. A linked list could have the data void* as the first member. If they posted a complete list of all the types they have found and which ones had non-standard vtables, it might be easier to make a call on whether it was done by hand or not.