ctorhack

ctorhack.cpp

#include <new>

typedef uintptr_t addr;

enum
{
	PATCH_CALL,
	PATCH_JUMP,
	PATCH_NOTHING,
	HOOK_SIZE = 5,
};

template<typename HT> inline void InjectHook(DWORD address, HT hook, int nType = PATCH_NOTHING)
{
	DWORD dwProtect[2];
	switch (nType)
	{
	case PATCH_JUMP:
		VirtualProtect((void *)address, HOOK_SIZE, PAGE_EXECUTE_READWRITE, &dwProtect[0]);
		*(BYTE *)address = 0xE9;
		break;
	case PATCH_CALL:
		VirtualProtect((void *)address, HOOK_SIZE, PAGE_EXECUTE_READWRITE, &dwProtect[0]);
		*(BYTE *)address = 0xE8;
		break;
	default:
		VirtualProtect((void *)((DWORD)address + 1), HOOK_SIZE - 1, PAGE_EXECUTE_READWRITE, &dwProtect[0]);
		break;
	}
	DWORD dwHook;
	_asm
	{
		mov	eax, hook
		mov	dwHook, eax
	}

	*(ptrdiff_t *)((DWORD)address + 1) = (DWORD)dwHook - (DWORD)address - HOOK_SIZE;

	if (nType == PATCH_NOTHING)
		VirtualProtect((void *)((DWORD)address + 1), HOOK_SIZE - 1, dwProtect[0], &dwProtect[1]);
	else
		VirtualProtect((void *)address, HOOK_SIZE, dwProtect[0], &dwProtect[1]);
}

inline void ExtractCall(void *dst, addr a)
{
	*(addr*)dst = (addr)(*(addr *)(a+1) + a + 5);
}

__declspec(naked) void hCVisFX_Lightning_Ctor(hCVisFX_Lightning *arg)
{
	__asm
	{
		mov eax, end
	}

	::new (arg) hCVisFX_Lightning();

	__asm
	{
		end:
	}
}

void somefunc(void)
{
	if (G12GetPrivateProfileBool("blablabla", FALSE))
	{
		hCVisFX_Lightning test;

		hCVisFX_Lightning_Ctor(&test);
	}

	volatile uint32_t calladdr = (*(uint32_t *)((uint32_t)&hCVisFX_Lightning_Ctor + 1)) - 5;
	uint32_t ctoraddr;
	ExtractCall(&ctoraddr, calladdr);

	InjectHook((uint32_t) hCVisFX_Lightning_Ctor, ctoraddr);

	// call own constructor somewhere
	// inject hook into own constructor to call non-ctor function with no cpp ctor magic
}