How to find the location of the vtable?

Question

Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following:

The main point to realize is that whenever we declare a C++ class with virtual methods, the pool of memory where it exists (the heap, the stack, etc.) now contains a pointer to a function pointer table which will eventually be used to call the function. In the event of an overflow, we can overwrite this pointer value so that our code will be called the next time a virtual method is called.

So, my question is, how do I find the location of the vtable pointer ?

I mean, do I have to search through PEB like when I am trying to find the base address from some modules. Or, is this specific for each situation ?

Answer 1

This is compiler dependent - the compiler may place the vtable wherever it wants to, as long as it does it consistently. However, in most cases, the vtable pointer is the first element (at offset 0) of the generated structure.

class test {
    int a;
    int b;
    test()          { ...; }
    ~test()         { ...; }
    void somefunc() { ...; }
    int c;
}

would use this memory layout for the class:

+----------------+               +--------------+
|  vtable        | ------------> | test         |
+----------------+               +--------------+
|  a             |               | ~test        |
+----------------+               +--------------+
|  b             |               | somefunc     |
+----------------+               +--------------+
|  c             |
+----------------+

so (assuming pointers and integers are all 4 bytes), the vtable is at offset 0, a at 4, b at 8 and c at 12.

Note that not all compilers use this convention. For example, the Watcom C++ 386 compiler didn't use a vtable at all, but mixed the function pointers with data. (I know this case because i once disassembled a game that was compiled with Watcom 20 years ago. Not that i expect you to ever see this kind of layout in a modern compiler, just to provide an example that it can be different):

+----------------+
|  test          |
+----------------+
|  ~test         |
+----------------+
|  a             |
+----------------+
|  b             |
+----------------+
|  somefunc      |
+----------------+
|  c             |
+----------------+

The entries at offset 0 and 4 (again, assuming 4 byte integers/pointers) are the parameterless constructor and destructor function of the class, the rest is a mix of variables and methods in the order they appear in the class definition. Of course, this is horribly inefficient, because the compiler has to initialize every class method whenever an object is instantiated, instead of just setting one pointer to the vtable.

TL;DR: In most cases, the vtable pointer is the first element of the class structure, but you really need to know which compiler was used and which conventions this compiler has.

Another thing - you talk about a "vtable overflow" in your original post. Your "normal" exploit doesn't overflow a vtable; the vtables are pre-initialized when your program starts, and (normally) never ever change. To write an exploit, you would either:

1. use a buffer overflow to modify a function pointer in a vtable, so the next time the class method gets called, your code is executed instead
2. use a buffer overflow to modify the vtable pointer of a class instance, so the next time this class instance executes a method, your vtable is used instead of the other one.

As vtables normally don't change, and may even be placed in a read-only memory segment by the compiler, your normal exploit ignores 1. and uses 2.