Crack the access control of C++ class by the use of virtual table.

crack_private.cc

#include <stddef.h>
#include <iostream>

class Base {
 public:
  virtual void f() {
    std::cout << "Your are calling Base::f (public)." << std::endl;
  }

 private:
  virtual void g() {
    std::cout << "Your are calling Base::g (private)." << std::endl;
  }
};

class Derived : public Base{};

using funcptr_t = void(*)(void);
using ptr_t     = uint64_t*;

funcptr_t fuckcxx(Base* const ptr, const ptrdiff_t offset) {
  ptr_t pvtbl = reinterpret_cast<ptr_t>(ptr);
  ptr_t pfunc = reinterpret_cast<ptr_t>(*pvtbl);
  return reinterpret_cast<funcptr_t>(*(pfunc + offset));
}

int main() {
    Derived d;
    auto f = fuckcxx(&d, 0);
    auto g = fuckcxx(&d, 1);
    f(); g();
    return 0;
}