#vtable

[ngodingkode-blog-blog]

Hooking (hot patching) class member functions. Modifying vtable entries

Hooking (hot patching) class member functions. Modifying vtable entries

I have 2 questions, after a rather long preamble.

By looking at any function pointer as at a void* I am able to modify its first instructions, transform them into a jmp (either 32 bit relative or 64 bit absolute, via r11, depending on x86/x86-64). I believe that looking at function code as at data is illegal in both C and C++, but it somehow seems to work, in an unsupported way, in both MSVC…

View On WordPress

[codinpsycho]

Basics of Virtual Functions

WORKING OF VIRTUAL FUNCTIONS The address of all the functions are known at compile time with the exception of virtual functions. There address is not known at until run time, this is an example of late binding. One of d factors deciding the size of an executable (.exe) depends on this binding if a lot of early binding is done d size tends to increase and with late binding the size tends to decrease. In the world of VIRTUAL functions there are "VTABLES" and "VPTRS" VTABLES: They are an array of function pointers which holds the addresses of all the virtual functions. Only 1 VTABLE is generated for a single class VPTRS: It is a pointer which points at a location inside the VTABLE.Each object will have a VPTR which points to the correct location in a VTABLE. SO what happens when we call a virtual function 1.VPTR of that object is fetched 2.Offset in the VTABLE is calculated 3. At that offset is d function pointer which is pointing to the virtual function which is then fetched 4. finally the function call is made. Though the actual memory footprint of a virtual function is very complex but dis is d crux of what happens behind and should give u a basic understanding. NOTE: Compilers are smart enough to optimize VIRTUAL function calls. For eg: class A { virtual void func(); } class B : public A { virtual void func(); } int main() { A* obj = new B(): B* obj1 = new B(): obj.func(); \\Virtual function overhead, VTABLE lookup occurs here obj1.func(); \\No overhead here simple member function call passing a "this" pointer. return 0; }

[fermanlao]

#vw #bgc #vtable so that's what it is. #cool

[clr-man-jvm-world]

Virtually awesome

Author's disclaimer: This is a HUGE topic and I'm going to give a fairly brief treatment.  Consider this a starting place for the question, not the answer.

In Scala, methods are all virtual by default.  You can opt-out with the "final" keyword, and even partially opt-out for inlining by sealing the class. In C#, methods are non-virtual by default.  You opt-in with the "virtual" keyword.  It is worth mentioning that overridden abstract methods are virtual, implemented interface methods are non-virtual in C#, but that's not the point.  

There is a deep philosophical difference here.  Scala expects class consumers to override methods.  You can even override with an anonymous class in a method.  Very powerful, kind of bugs me out.  In C#, the expectation is that the base class author should have more control over how consumers will use their stuff, and there are potential efficiency gains that go along with that.  

There may be no greater metaphor for the relationship between the open-source-centric Java world and the closed-source Microsoft world than this single design decision.  As a guy who prefers writing core library/infrastructure code, I think I prefer the Microsoft approach here, but the power of mix-ins and anonymous overrides in Scala are pretty darned cool.

Let's consider these classes, defined in vaguely agnostic and very explicit pseudo-code:

class Foo { methodA; methodB; virtual methodC; }

class Bar inherits Foo { new methodB; override methodC; }

When the instance of type "Bar" has been cast into a reference of "Foo," which bodies to call?

The answer depends on how the method was declared:

barInstance.methodA => Foo.methodA

((Foo)barInstance).methodA => Foo.methodA

barInstance.methodB => Bar.methodB

((Foo)barInstance).methodB => Foo.methodB

barInstance.methodC => Bar.methodC

((Foo)barInstance).methodC => Bar.methodC

#1 and #2 are equivalent, for obvious reasons.  Bar didn't declare a body for methodA, so you have to invoke Foo.methodA.  But how do #3/4 and #5/6 differ?  Syntax aside, the answer is that virtual methods are referenced from a v-table.  The instance is carrying around it's type information, which has a table of pointers to implementations.  When you call methodC, the instance looks the body up in the table and invokes it.  However, methodB is not virtual; it is invoked on the type.  So if an instance of Bar is masquerading as a Foo, it had better be ready to invoke Foo's body for methodB.

This is a powerful thing!  The naive way to think about these things strongly favors the behavior of virtual methods, but there is a cost.  Virtual methods pay for that v-table lookup.  Much more importantly, it is very easy to inline non-virtual methods at compile time.  Inlining virtual methods cannot be done until JIT time, and even then is path fraught with danger.  In other words, non-virtual methods can significantly more efficient to call.  How significant depends on how much work the method is doing in its body, YMMV.