3

I have injected a DLL into an external application that is based on the QT framework. I, then, use the method QApplication::allWidgets() and iterate through the list of widgets to find a QGraphicsView that represents the window I want to interact with.

The buttons and other controls in the scene are all derived from QGraphicsObject. But, I don't have the source. So, I can only cast to QGraphicsObject and not to the actual type.

The list of methods from the meta-object is incomplete, which is to be expected, because I cast to a QGraphicsObject. I can find the method names using IDA though.

Is it possible to call a particular method, and how would you do it?

6
  • I would probably try and walk the objects vtable (don't cast it to QGraphicsObject).
    – fileoffset
    Jul 15, 2015 at 7:22
  • As an aside, are you sure the functions you're calling are thread-safe? Jul 15, 2015 at 15:15
  • @fileoffset I will try this, but I am not familiar with how to find the method in the vtable. I will do some research, but if you have a link to a relevant article, please post it.
    – pokerguy
    Jul 17, 2015 at 3:45
  • @JasonGeffner I am not sure if it is. Is there anyway to determine this without having the source?
    – pokerguy
    Jul 17, 2015 at 3:46
  • Unfortunately there is no standard for vtables, each compiler can implement it how it likes. Can you determine which compiler&version was used to create the binary? If it was MSVS, what you can do is install that version of MSVS, and then write a small test program with a basic class that inherits from QGraphicsObject. Then you can compile it with some special flags (see answer #2 here: stackoverflow.com/questions/302446/…) and MSVS will output the format of the object, including the vtable.
    – fileoffset
    Jul 17, 2015 at 6:27

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.