Raised This Month: $12 Target: $400
 3% 

[IDA/DHooks]How to get vtable offsets


  
 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
berni
SourceMod Plugin Approver
Join Date: May 2007
Location: Austria
Old 04-13-2015 , 16:24   Re: [IDA/DHooks]How to get vtable offsets
Reply With Quote #11

Well, at first you need a Disassembler like IDA, to analyze the binary.

Every compiled function has a signature. You can think of a signature as a unique byte pattern after the binary executable file is loaded into memory. But signatures are a bit trickier to create, because the function signature alone is most times not enough (I think), so you need some bytes from the function body too or the surrounding, and those bytes can vary, so you need to replace them with placeholders, that needs some basic assembler knowledge, more info: https://wiki.alliedmods.net/Signature_scanning

Offsets on the other side are much easier, because all you need to know to identify a unique function is the class of the object (in C++ mangled format, like _ZTV13CTerrorPlayer) and the virtual function index. _ZTV13CTerrorPlayer is encoded name and means "Virtual table of class CTerrorPlayer".
Offsets are much easier to find because you can just read the Vtable index of a class, but they also often break very fast because new functions are added, or functions are removed, and then the offsets is not correct anymore... more info: https://forums.alliedmods.net/showthread.php?t=191171
https://forums.alliedmods.net/showthread.php?t=191328

As a beginner, you will most times want to use the offset because it's easier to find.
__________________
Why reinvent the wheel ? Download smlib with over 350 useful functions.

When people ask me "Plz" just because it's shorter than "Please" I feel perfectly justified to answer "No" because it's shorter than "Yes"
powered by Core i7 3770k | 32GB DDR3 1886Mhz | 2x Vertex4 SSD Raid0
berni is offline
 


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -4. The time now is 01:00.


Powered by vBulletin®
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Theme made by Freecode