Advertisement
Guest User

Stealthed VMT Hooking

a guest
Jun 22nd, 2018
131
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.75 KB | None | 0 0
  1. inline void Setup(void *base, const char * moduleName = false)
  2. {
  3. if (base != nullptr)
  4. class_base = base;
  5.  
  6. if (class_base == nullptr)
  7. return;
  8.  
  9. original_vtable = *(std::uintptr_t**)class_base;
  10. method_count = estimate_vftbl_length(original_vtable) * sizeof(std::uintptr_t);
  11.  
  12. if (method_count == 0)
  13. return;
  14.  
  15.  
  16. if (moduleName)// If provided a module name then we will find a place in that module
  17. {
  18. shadow_vtable = search_free_data_page(moduleName, method_count + sizeof(std::uintptr_t));
  19. std::memset(shadow_vtable, NULL, method_count + sizeof(std::uintptr_t));
  20. std::memcpy(&shadow_vtable[1], original_vtable, method_count);
  21. shadow_vtable[0] = original_vtable[-1];
  22. try {
  23. auto guard = protect_guard{ class_base, sizeof(std::uintptr_t), PAGE_READWRITE };
  24.  
  25. *(std::uintptr_t**)class_base = &shadow_vtable[1];
  26. if (table_is_hooked(base, moduleName))
  27. {
  28. Beep(500, 500);
  29. }
  30. }
  31. catch (...) {
  32. delete[] shadow_vtable;
  33. return;
  34. }
  35. }
  36. else // If not then we do regular vmthookinh
  37. {
  38. shadow_vtable = new std::uintptr_t[method_count + 1]();
  39. std::memcpy(&shadow_vtable[1], original_vtable, method_count);
  40. try {
  41. auto guard = protect_guard{ class_base, sizeof(std::uintptr_t), PAGE_READWRITE };
  42. shadow_vtable[0] = original_vtable[-1];
  43. *(std::uintptr_t**)class_base = &shadow_vtable[1];
  44. }
  45. catch (...) {
  46. delete[] shadow_vtable;
  47. return;
  48. }
  49. }
  50. return;
  51. }
  52.  
  53. inline void RestoreTable()
  54. {
  55.  
  56. try {
  57. if (original_vtable != nullptr) {
  58. auto guard = protect_guard{ class_base, sizeof(std::uintptr_t), PAGE_READWRITE };
  59. *(std::uintptr_t**)class_base = original_vtable;
  60. original_vtable = nullptr;
  61. }
  62. }
  63. catch (...) {
  64. }
  65. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement