2y ago · Jun 20, 2024 11:45 AM
Virtual Method Tables (VMT) are the mechanism C++ compilers use to implement dynamic dispatch / polymorphism.
In memory, an object with virtual methods begins with a pointer to its virtual method table (), which is an array of function pointers stored in the PE's section.
Calling Virtual Methods by Index:
Hooking via VMT Swapping (Shadow VMT):
Instead of writing directly to read-only memory, you copy the original table into a newly allocated heap array, replace the target method pointer with your hook, and point the object's to your shadow table!
In memory, an object with virtual methods begins with a pointer to its virtual method table (
CPP
vptr CODE
.rdataCalling Virtual Methods by Index:
CPP
template <typename Fn, typename... Args>
inline Fn CallVirtual(void* instance, size_t index, Args... args) {
void** vtable = *reinterpret_cast<void***>(instance);
return reinterpret_cast<Fn>(vtable[index])(instance, args...);
}Hooking via VMT Swapping (Shadow VMT):
Instead of writing directly to read-only memory, you copy the original table into a newly allocated heap array, replace the target method pointer with your hook, and point the object's
CODE
vptr
VMT_Hooker - Virtual method table swapping made easy
The following users thanked VMT_Hooker for this post: