Hey, gonna share a nice vmt hook class written by myself with you
It's undetected by vac signatures, and the implemented method is just replacing the vftable ptr.
I also show you a little example on how to use it, although its actually really self-explaining but yeah.
so have phun.
Code:
#include <Windows.h>
class VFTHook
{
public:
VFTHook()
{
}
void AssignClass(DWORD **ppBase)
{
ppClass = ppBase;
pVTable = *ppBase;
iFunctionCount = GetCount();
pNewVTable = new DWORD[iFunctionCount];
memcpy(pNewVTable, pVTable, sizeof(DWORD) * iFunctionCount);
*ppBase = pNewVTable;
}
unsigned GetCount(/*DWORD* vtable*/)
{
if (!pVTable)
return;
int i = 0;
while (true)
{
if (!pVTable[i] || IsBadCodePtr((FARPROC)pVTable[i]))
break;
i++;
}
return i;
}
DWORD HookFunction(DWORD dwFunc, int iIndex)
{
if (pNewVTable && iIndex >= 0 && iIndex <= iFunctionCount && pVTable)
{
pNewVTable[iIndex] = dwFunc;
return pVTable[iIndex];
}
return NULL;
}
~VFTHook()
{
delete pNewVTable;
}
protected:
DWORD** ppClass;
DWORD* pVTable;
DWORD* pNewVTable;
unsigned iFunctionCount;
} *pInterfaceHook, *pClassHook;
/// Usage:
typedef void(__thiscall *oPaintTraverse)(void*, unsigned int, bool, bool);
oPaintTraverse pPT = nullptr;
/// example to store interface pointers, which we can grab before via CreateInterface engine function
namespace Interfaces
{
void* IPanel,
ISurface,
IVEngineClient;
};
/// modified function e.g.
void __fastcall hkPT(void* pthis, void*, unsigned int vguipanel, bool forcerepaint, bool allowforce)
{
pPT(pthis, vguipanel, forcerepaint, allowforce);
// do whatever you want, like checking the panel to draw and init isurface
}
/// called by dllmain e.g.
void demo()
{
//CreateInterface vgui2 = (CreateInterfaceFn) GetProcAddress(GetModuleHandleA("vgui2.dll"), "CreateInterface");
//CreateInterfaceFn engineinterface = (CreateInterfaceFn) GetProcAddress(GetModuleHandleA("engine.dll"), "CreateInterface");
//Interfaces::IPanel = (void*)vgui2("VGUI_Panel009", 0);
pInterfaceHook->AssignClass((DWORD**)Interfaces::IPanel);
pPT = (oPaintTraverse)pInterfaceHook->HookFunction((DWORD)hkPT, 41);
}
///
Hey, gonna share a nice vmt hook class written by myself with you
It's undetected by vac signatures, and the implemented method is just replacing the vftable ptr.
I also show you a little example on how to use it, although its actually really self-explaining but yeah.
so have phun.
Code:
#include <Windows.h>
class VFTHook
{
public:
VFTHook()
{
}
void AssignClass(DWORD **ppBase)
{
ppClass = ppBase;
pVTable = *ppBase;
iFunctionCount = GetCount();
pNewVTable = new DWORD[iFunctionCount];
memcpy(pNewVTable, pVTable, sizeof(DWORD) * iFunctionCount);
*ppBase = pNewVTable;
}
unsigned GetCount(/*DWORD* vtable*/)
{
if (!pVTable)
return;
int i = 0;
while (true)
{
if (!pVTable[i] || IsBadCodePtr((FARPROC)pVTable[i]))
break;
i++;
}
return i;
}
DWORD HookFunction(DWORD dwFunc, int iIndex)
{
if (pNewVTable && iIndex >= 0 && iIndex <= iFunctionCount && pVTable)
{
pNewVTable[iIndex] = dwFunc;
return pVTable[iIndex];
}
return NULL;
}
~VFTHook()
{
delete pNewVTable;
}
protected:
DWORD** ppClass;
DWORD* pVTable;
DWORD* pNewVTable;
unsigned iFunctionCount;
} *pInterfaceHook, *pClassHook;
/// Usage:
typedef void(__thiscall *oPaintTraverse)(void*, unsigned int, bool, bool);
oPaintTraverse pPT = nullptr;
/// example to store interface pointers, which we can grab before via CreateInterface engine function
namespace Interfaces
{
void* IPanel,
ISurface,
IVEngineClient;
};
/// modified function e.g.
void __fastcall hkPT(void* pthis, void*, unsigned int vguipanel, bool forcerepaint, bool allowforce)
{
pPT(pthis, vguipanel, forcerepaint, allowforce);
// do whatever you want, like checking the panel to draw and init isurface
}
/// called by dllmain e.g.
void demo()
{
//CreateInterface vgui2 = (CreateInterfaceFn) GetProcAddress(GetModuleHandleA("vgui2.dll"), "CreateInterface");
//CreateInterfaceFn engineinterface = (CreateInterfaceFn) GetProcAddress(GetModuleHandleA("engine.dll"), "CreateInterface");
//Interfaces::IPanel = (void*)vgui2("VGUI_Panel009", 0);
pInterfaceHook->AssignClass((DWORD**)Interfaces::IPanel);
pPT = (oPaintTraverse)pInterfaceHook->HookFunction((DWORD)hkPT, 41);
}
///