Class dump and CFObjects

Question

Does class dump get confused by CFObjects/structs? I used class dump on an application and one of the method's argument was a struct arg1 which is a BInstantMessage:

struct BInstantMessage {
    void **_field1;
    struct CFString _field2;
    unsigned short *_field3;
    struct DTextStyle _field4;
    struct BUser *_field5;
    struct BChat *_field6;
};

struct CFString {
    void **_vptr$CFObject;
    struct __CFString *mCFRef;
    _Bool mIsMutable;
};

struct __CFString;

So, how can I get a CFStringRef or NSString* from this arg1? I am guess that class dump is replacing some CFStringRef by CFString definitions, but it's just a guess... All I want is to get a CFStringRef from arg1 which is a BInstantMessage.

Thnaks!

Answer 1

The application is using a C++ wrapper for Core Foundation objects. the struct CFString in BInstantMessage is an object of this type. You want (NSString *)(arg1._field2.mCFRef).

The void **_vptr$CFObject field is the major hint here – it represents the vtable for a virtual superclass CFObject – combined with the common C++ m prefix naming convention.