Vftable Hook class | undetected

Posts 1–4 of 4 · Page 1 of 1
Vftable Hook class | undetected
Hey, gonna share a nice vmt hook class written by myself with you
It's undetected by vac signatures, and the implemented method is just replacing the vftable ptr.
I also show you a little example on how to use it, although its actually really self-explaining but yeah.
so have phun.

Code:
#include <Windows.h>

class VFTHook
{
public:
	VFTHook()
	{

	}

	void AssignClass(DWORD **ppBase)
	{
		ppClass = ppBase;
		pVTable = *ppBase;
		iFunctionCount = GetCount();
		pNewVTable = new DWORD[iFunctionCount];
		memcpy(pNewVTable, pVTable, sizeof(DWORD) * iFunctionCount);
		*ppBase = pNewVTable;
	}

	unsigned GetCount(/*DWORD* vtable*/)
	{
		if (!pVTable)
			return;

		int i = 0;
		while (true)
		{
			if (!pVTable[i] || IsBadCodePtr((FARPROC)pVTable[i]))
				break;

			i++;
		}

		return i;
	}

	DWORD HookFunction(DWORD dwFunc, int iIndex)
	{
		if (pNewVTable && iIndex >= 0 && iIndex <= iFunctionCount && pVTable)
		{
			pNewVTable[iIndex] = dwFunc;
			return pVTable[iIndex];
		}

		return NULL;
	}

	~VFTHook()
	{
		delete pNewVTable;
	}


protected:
	DWORD** ppClass;
	DWORD* pVTable;
	DWORD* pNewVTable;
	unsigned iFunctionCount;
} *pInterfaceHook, *pClassHook;


/// Usage:

typedef void(__thiscall *oPaintTraverse)(void*, unsigned int, bool, bool);
oPaintTraverse pPT = nullptr;

/// example to store interface pointers, which we can grab before via CreateInterface engine function
namespace Interfaces
{
	void* IPanel,
		ISurface,
		IVEngineClient;
};

/// modified function e.g.
void __fastcall hkPT(void* pthis, void*, unsigned int vguipanel, bool forcerepaint, bool allowforce)
{
	pPT(pthis, vguipanel, forcerepaint, allowforce);

	// do whatever you want, like checking the panel to draw and init isurface
}

/// called by dllmain e.g.
void demo()
{
	//CreateInterface vgui2 = (CreateInterfaceFn) GetProcAddress(GetModuleHandleA("vgui2.dll"), "CreateInterface");
	//CreateInterfaceFn engineinterface = (CreateInterfaceFn) GetProcAddress(GetModuleHandleA("engine.dll"), "CreateInterface");
	//Interfaces::IPanel = (void*)vgui2("VGUI_Panel009", 0);


	pInterfaceHook->AssignClass((DWORD**)Interfaces::IPanel);
	pPT = (oPaintTraverse)pInterfaceHook->HookFunction((DWORD)hkPT, 41);
}
///
Quote Originally Posted by _PuRe.LucK* View Post
Hey, gonna share a nice vmt hook class written by myself with you
It's undetected by vac signatures, and the implemented method is just replacing the vftable ptr.
I also show you a little example on how to use it, although its actually really self-explaining but yeah.
so have phun.

Code:
#include <Windows.h>

class VFTHook
{
public:
	VFTHook()
	{

	}

	void AssignClass(DWORD **ppBase)
	{
		ppClass = ppBase;
		pVTable = *ppBase;
		iFunctionCount = GetCount();
		pNewVTable = new DWORD[iFunctionCount];
		memcpy(pNewVTable, pVTable, sizeof(DWORD) * iFunctionCount);
		*ppBase = pNewVTable;
	}

	unsigned GetCount(/*DWORD* vtable*/)
	{
		if (!pVTable)
			return;

		int i = 0;
		while (true)
		{
			if (!pVTable[i] || IsBadCodePtr((FARPROC)pVTable[i]))
				break;

			i++;
		}

		return i;
	}

	DWORD HookFunction(DWORD dwFunc, int iIndex)
	{
		if (pNewVTable && iIndex >= 0 && iIndex <= iFunctionCount && pVTable)
		{
			pNewVTable[iIndex] = dwFunc;
			return pVTable[iIndex];
		}

		return NULL;
	}

	~VFTHook()
	{
		delete pNewVTable;
	}


protected:
	DWORD** ppClass;
	DWORD* pVTable;
	DWORD* pNewVTable;
	unsigned iFunctionCount;
} *pInterfaceHook, *pClassHook;


/// Usage:

typedef void(__thiscall *oPaintTraverse)(void*, unsigned int, bool, bool);
oPaintTraverse pPT = nullptr;

/// example to store interface pointers, which we can grab before via CreateInterface engine function
namespace Interfaces
{
	void* IPanel,
		ISurface,
		IVEngineClient;
};

/// modified function e.g.
void __fastcall hkPT(void* pthis, void*, unsigned int vguipanel, bool forcerepaint, bool allowforce)
{
	pPT(pthis, vguipanel, forcerepaint, allowforce);

	// do whatever you want, like checking the panel to draw and init isurface
}

/// called by dllmain e.g.
void demo()
{
	//CreateInterface vgui2 = (CreateInterfaceFn) GetProcAddress(GetModuleHandleA("vgui2.dll"), "CreateInterface");
	//CreateInterfaceFn engineinterface = (CreateInterfaceFn) GetProcAddress(GetModuleHandleA("engine.dll"), "CreateInterface");
	//Interfaces::IPanel = (void*)vgui2("VGUI_Panel009", 0);


	pInterfaceHook->AssignClass((DWORD**)Interfaces::IPanel);
	pPT = (oPaintTraverse)pInterfaceHook->HookFunction((DWORD)hkPT, 41);
}
///
Neat! Thanks m8 <3
Please, don't use IsBad<X>Ptr.
I kri everytime.
Posts 1–4 of 4 · Page 1 of 1

Post a Reply

Similar Threads

Tags for this Thread

None

Talk with us