1

I know how to find and hook virtual methods by crawling an object's RTTI. I cannot find enough information about non-virtual class methods.

  1. Is there anyway to identify non-virtual class methods at run-time?

  2. Can I use a class's symbol name to recover any information about it at run-time?

Improve this question

1 Answer 1

Reset to default
2

There's no sure-proof way to do it. Non-virtual methods look exactly like normal functions except they take an implicit 'this' pointer. If you are dealing with visual C++ compiled program then it will probably be a bit more obvious as usually it uses thiscall calling convention so you just need to watch for cases when the instance address is in ecx at function entry. See my article for more details.

Of course, if you have symbols then it's very easy - just check for classname:: prefix in the demangled function name.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.