TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Overriding C++ virtual functions at run time

59 pointsby topiollialmost 5 years ago

9 comments

jcelerieralmost 5 years ago
&gt; The C++ standard does not specify how virtual functions should be implemented. In practice, however, compilers generate a virtual function table and place a pointer to it as the first member of a class.<p>wishful thinking: <a href="https:&#x2F;&#x2F;gcc.godbolt.org&#x2F;z&#x2F;qWEe9r" rel="nofollow">https:&#x2F;&#x2F;gcc.godbolt.org&#x2F;z&#x2F;qWEe9r</a>
评论 #24098567 未加载
评论 #24098549 未加载
bregmaalmost 5 years ago
We were overriding non-virtual functions at run time in the 8-bit days. Even in the feature article&#x27;s case it would be easier and more reliable to patch the GOT (since he&#x27;s using ELF on Linux).<p>It&#x27;s hardly news but I guess it makes this common cracking technique more accessible.
评论 #24100558 未加载
mehrdadaalmost 5 years ago
As you might imagine, overwriting vtables in memory is a common technique to hijack control flow and making your program execute attacker&#x27;s code in an exploit.
评论 #24098715 未加载
Someonealmost 5 years ago
In Objective-C, that’s called “method swizzling”, and better supported by the runtime. See <a href="https:&#x2F;&#x2F;nshipster.com&#x2F;method-swizzling&#x2F;" rel="nofollow">https:&#x2F;&#x2F;nshipster.com&#x2F;method-swizzling&#x2F;</a><p>And of course, Common Lisp has “change-class” (<a href="https:&#x2F;&#x2F;www.snellman.net&#x2F;blog&#x2F;archive&#x2F;2015-07-27-use-cases-for-change-class-in-common-lisp&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.snellman.net&#x2F;blog&#x2F;archive&#x2F;2015-07-27-use-cases-f...</a>, discussed at <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=734025" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=734025</a>) and Smalltalk has “become:” (<a href="https:&#x2F;&#x2F;gbracha.blogspot.com&#x2F;2009&#x2F;07&#x2F;miracle-of-become.html" rel="nofollow">https:&#x2F;&#x2F;gbracha.blogspot.com&#x2F;2009&#x2F;07&#x2F;miracle-of-become.html</a>. Short discussion at <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=734025" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=734025</a>)
jamesualmost 5 years ago
Had to go a step further in a project and patch static functions in a codebase with no source. It’s certainly enlightening how much you can do with just a symbol map and type info.<p>I don’t think the articles vtable layout is entirely accurate for gcc though - usually you’ll get 2 destructors at the start of the vtable (assuming the first virtual func declared is the destructor).
评论 #24099424 未加载
The_rationalistalmost 5 years ago
I was wondering whether such a thing is possible for JVM based languages and it turns out it is: <a href="https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;8273685&#x2F;is-it-possible-to-override-a-method-at-runtime" rel="nofollow">https:&#x2F;&#x2F;stackoverflow.com&#x2F;questions&#x2F;8273685&#x2F;is-it-possible-t...</a>
评论 #24101878 未加载
评论 #24098846 未加载
ppg677almost 5 years ago
FDO compilation will often de-virtualize and remove vtable indirection.
rurbanalmost 5 years ago
AutoCad does this in their ObjectARX technology, with a fixed compiler version, to support user or vendor provided plugins to extend classes. At runtime. For decades.
评论 #24099386 未加载
rootlocusalmost 5 years ago
This all fine and well for single public inheritance. Multiple inheritance and virtual inheritance don&#x27;t generate layouts this simple.