1

I know how to find and hook virtual methods by crawling an object's RTTI. I cannot find enough information about non-virtual class methods.

  1. Is there anyway to identify non-virtual class methods at run-time?

  2. Can I use a class's symbol name to recover any information about it at run-time?

2

There's no sure-proof way to do it. Non-virtual methods look exactly like normal functions except they take an implicit 'this' pointer. If you are dealing with visual C++ compiled program then it will probably be a bit more obvious as usually it uses thiscall calling convention so you just need to watch for cases when the instance address is in ecx at function entry. See my article for more details.

Of course, if you have symbols then it's very easy - just check for classname:: prefix in the demangled function name.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.