/// <summary> /// Hooks an individual vtable function pointer from a already hooked vtable pointer. /// </summary> /// <param name="vTableHook">The already hooked virtual function table</param> /// <param name="originalVirtualFunctionTableAddress">The address of the original virtual function pointer /// This will be read to store the original function pointer</param> /// <param name="index">The index of the virtual function pointer in the virtual function table</param> /// <param name="function">The hook function</param> internal unsafe VTableEntryHook(HookedObjectVirtualFunctionTable vTableHook, nuint originalVirtualFunctionTableAddress, int index, TFunction function) { CurrentProcess.SafeRead(originalVirtualFunctionTableAddress + (nuint)(index * sizeof(nuint)), out nuint originalFunctionAddress); _vTableHook = vTableHook; _index = index; _is64Bit = sizeof(IntPtr) == 8; ReverseWrapper = CreateReverseWrapper(function); OriginalFunction = CreateWrapper(originalFunctionAddress, out nuint originalFunctionWrapperAddress); OriginalFunctionAddress = originalFunctionAddress.ToSigned(); OriginalFunctionWrapperAddress = originalFunctionWrapperAddress.ToSigned(); IsHookActivated = false; }
/// <summary> /// Gets all addresses belonging to a virtual function table. /// </summary> /// <param name="tablePointer">Pointer to the virtual table itself.</param> /// <param name="numberOfMethods">The number of methods stored in the virtual table.</param> public static List <TableEntry> GetAddresses(IntPtr tablePointer, int numberOfMethods) { // Stores the addresses of the virtual function table. var tablePointers = new List <TableEntry>(); // Append the table pointers onto the tablePointers list. // Using the size of the IntPtr allows for both x64 and x86 support. for (int i = 0; i < numberOfMethods; i++) { var targetAddress = tablePointer + (IntPtr.Size * i); CurrentProcess.SafeRead(targetAddress, out IntPtr functionPtr); tablePointers.Add(new TableEntry { EntryAddress = targetAddress, FunctionPointer = functionPtr }); } return(tablePointers); }