Skip to content

Instantly share code, notes, and snippets.

@Jacob-Tate
Last active February 8, 2020 04:39
Show Gist options
  • Save Jacob-Tate/3229106f3f2a27cb1df601d62d03419d to your computer and use it in GitHub Desktop.
Save Jacob-Tate/3229106f3f2a27cb1df601d62d03419d to your computer and use it in GitHub Desktop.
// esi contains the struct ptr
// vtable = *(DWORD*)ptr
mov eax,dword ptr [esi]
// function = *(DWORD*)vtable
mov edx,dword ptr [eax]
// put the class pointer in ecx
// this = ptr
mov ecx,esi
// call the function!
// function()
call edx
// Someone memset our call destroying out vtable!
mov dword ptr [ecx], 0
mov eax, dword ptr [ecx]
mov edx, dword ptr [eax]
call edx
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment