The realization analysis of the principle of the virtual function table (when we replace the function in the virtual table address [n], then we control the implementation of the virtual function)

Source: Internet
Author: User

Principle Analysis

When a virtual function is called, the compiler-generated code calls a function such as the virtual table address [0] (param1, param2). The function name is not already being called.

When we change the function implementation in the virtual table address [n] to another function, we control the implementation of the virtual function.

Experiment

According to the principle of virtual table, experiment to modify the virtual function table entry address of your program.

When the compiler-generated code executes a virtual function A, it executes the non-virtual function B that we define ourselves.

Knowledge points

* Use union assignment to bypass compiler functions and variable strongly-assigned value restrictions

* Execution of class member function pointers

* Modify and restore your own code snippet properties

* Positioning and reading and writing of virtual function table entries

Experiment Code

[CPP]View PlainCopy
  1. virtual void Fnfoo (); < CC ' s Fnfoo
  2. typedef VOID (CC::* Pfn_fnfoo) ();
  3. typedef Union UN_FUNCTION_PT
  4. {
  5. Pfn_fnfoo PFN;
  6. int ifunaddr;
  7. }un_function_pt;
  8. void Fnreplacevirtualfunction ()
  9. {
  10. /// Replace the virtual table function experiment
  11. /// through experiments, there are 2 cc virtual functions
  12. /// virtual function 1 cc destructor
  13. /// virtual function 2 Cc::fnfoo
  14. ////We will replace the Cc::fnfoo in the virtual table with Fnnewvirtualfunction ()
  15. int ivirtualtbladdr = 0; ///< cc virtual function table address
  16. int ivirtualfunctionaddr_cc_fnfoo = 0; ///< Address of the Cc::fnfoo object method
  17. Un_function_pt UNFUNPT; ///< for int to fun*, bypassing compiler restrictions
  18. DWORD dwoldprotect = 0;
  19. ca* PCA = new CC ();
  20. IVIRTUALTBLADDR = * ((int*) PCA);
  21. Ivirtualfunctionaddr_cc_fnfoo = * ((int*) ivirtualtbladdr + 1);
  22. /// The original function of executing cc.fnfoo virtual function
  23. UNFUNPT.IFUNADDR = Ivirtualfunctionaddr_cc_fnfoo;
  24. (((cc*) PCA)->*UNFUNPT.PFN) ();
  25. /// manual execution of PCA Fnnewfunctionsamedefineasfnfoo
  26. /// Let CC instance execute our own specified CC class member function
  27. /// must be a function of the same parameter return value as the CC class already has
  28. UNFUNPT.PFN = &CC::fnNewFunctionSameDefineAsfnFoo;
  29. (((cc*) PCA)->*UNFUNPT.PFN) ();
  30. //Make memory writable
  31. if (VirtualProtect ((void*) ivirtualtbladdr, 8, Page_execute_readwrite, &dwoldprotect))
  32. {
  33. /// replace the Cc::fnfoo in the virtual table as Cc::fnnewfunctionsamedefineasfnfoo
  34. UNFUNPT.PFN = &CC::fnNewFunctionSameDefineAsfnFoo;
  35. ///< does not release the write limit 0x0040 the code snippet, it C05
  36. * ((int*) ivirtualtbladdr + 1) = unfunpt.ifunaddr;
  37. //Reprotect
  38. VirtualProtect ((void*) ivirtualtbladdr, 8, Dwoldprotect, NULL);
  39. /// execute Pca->fnfoo becomes the execution Pca->fnnewfunctionsamedefineasfnfoo
  40. Pca->fnfoo ();
  41. //OK has executed the function of our own specified CC and cc::fnfoo with the same parameter return value.
  42. /// This function can be a non-virtual function
  43. }
  44. }

[CPP]View PlainCopy
  1. Classtest.h:interface for the Cclasstest class.
  2. //
  3. //////////////////////////////////////////////////////////////////////
  4. #if!defined (Afx_classtest_h__d794cc4b_d79e_4a61_9d5a_95110788ae39__included_)
  5. #define Afx_classtest_h__d794cc4b_d79e_4a61_9d5a_95110788ae39__included_
  6. #if _msc_ver > 1000
  7. #pragma once
  8. #endif//_msc_ver > 1000
  9. #include <iostream>
  10. Using namespace std;
  11. Class CA
  12. {
  13. Public
  14. CA ();
  15. virtual ~ca ();
  16. virtual void Fnfoo ();
  17. };
  18. Class CB: Public CA
  19. {
  20. Public
  21. CB ();
  22. virtual ~CB ();
  23. virtual void Fnfoo ();
  24. };
  25. Class CC: Public CB
  26. {
  27. Public
  28. CC ();
  29. virtual ~cc ();
  30. virtual void Fnfoo ();
  31. void Fnnewfunctionsamedefineasfnfoo ();
  32. };
  33. #endif//!defined (AFX_CLASSTEST_H__D794CC4B_D79E_4A61_9D5A_95110788AE39__INCLUDED_)

[CPP]View PlainCopy
  1. ClassTest.cpp:implementation of the Cclasstest class.
  2. //
  3. //////////////////////////////////////////////////////////////////////
  4. #include "ClassTest.h"
  5. //////////////////////////////////////////////////////////////////////
  6. Ca
  7. //////////////////////////////////////////////////////////////////////
  8. CA::CA ()
  9. {
  10. cout << "CA::CA" << Endl;
  11. }
  12. Ca::~ca ()
  13. {
  14. cout << "Ca::~ca" << Endl;
  15. }
  16. void Ca::fnfoo ()
  17. {
  18. cout << "Ca::fnfoo" << Endl;
  19. }
  20. //////////////////////////////////////////////////////////////////////
  21. Cb
  22. //////////////////////////////////////////////////////////////////////
  23. CB::CB ()
  24. {
  25. cout << "CB::CB" << Endl;
  26. }
  27. CB::~CB ()
  28. {
  29. cout << "CB::~CB" << Endl;
  30. }
  31. void Cb::fnfoo ()
  32. {
  33. cout << "Cb::fnfoo" << Endl;
  34. }
  35. //////////////////////////////////////////////////////////////////////
  36. Cc
  37. //////////////////////////////////////////////////////////////////////
  38. CC::CC ()
  39. {
  40. cout << "cc::cc" << Endl;
  41. }
  42. CC::~CC ()
  43. {
  44. cout << "cc::~cc" << Endl;
  45. }
  46. void Cc::fnfoo ()
  47. {
  48. cout << "Cc::fnfoo" << Endl;
  49. }
  50. void Cc::fnnewfunctionsamedefineasfnfoo ()
  51. {
  52. ///A function to replace the same parameter of the virtual function with the return value
  53. cout << "Cc::fnnewfunctionsamedefineasfnfoo" << Endl;
  54. }



Implementation effect [CPP]View PlainCopy
    1. Ca::ca
    2. Cb::cb
    3. Cc::cc
    4. Cc::fnfoo
    5. Cc::fnnewfunctionsamedefineasfnfoo
    6. Cc::fnnewfunctionsamedefineasfnfoo

http://blog.csdn.net/lostspeed/article/details/50359445

The realization analysis of the principle of the virtual function table (when we replace the function in the virtual table address [n], then we control the implementation of the virtual function)

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.