Question

I’ve been trying to properly hook/detour a virtual function in a class object, and I’ve had success in terms of having a different function called, but I must be doing something that’s incorrect in terms of how the this keyword is passed to the function.

I read an article about hooking D3D functions in a similar fashion, and it mentioned that the compiler will turn a function such as int Class::method(int) into int method(Class* this, int), but if I replace the address in the vtable with a function that is defined as such, the address for ‘this’ is incorrect, so that’s probably not right.

How are member functions laid out by the compiler, and is it possible to represent it in non-member-function form so that I can set the address in the vtable to such a function and be able to refer to the appropriate object?

Answer 1

You need to define your function as thiscall. It passes this on the ecx register. The way you’ve done it, the function was expecting this on the stack and reading the wrong value which probably belonged to another argument.