Nikolay Igotti
Wednesday Jun 27, 2007
VTBL games
Little game with changing vtbl entry for an instance. Probably more interesting part would be class-wide modification, but it's usually in read only area (text segment). For completeness of demo we'll dispatch calls to regular function, not member function. On Windows this meansthis is not passed, as it uses a bit different calling convention
between member and regular functions (this in ECX).
#include <stdio.h>
#include <stdlib.h>
class A {
public:
virtual void foo() {
printf("A::foo(): %p\n", this);
}
};
class B : public A {
public:
virtual void foo() {
printf("B::foo(): %p\n", this);
}
};
A* get() {
if (rand() & 1) {
return new A();
} else {
return new B();
}
}
void bar(void* thiz) {
printf("bar: %p\n", thiz);
}
int main() {
A* a = get();
void* vt[] = { (void*)bar };
a->foo();
*(void**)a = &vt;
a->foo();
return 0;
}
Posted at 10:00PM Jun 27, 2007 by nike in Sun | Comments[0]
Comments: