pub fn scan_vtable<T: VirtualMemory>(
    process: &mut Win32Process<T>,
    interface_manager: &InterfaceManager,
    vtable: Address,
) -> Result<Vec<Function>> {
    let initial_module = interface_manager
        .modules()
        .iter()
        .find(|m| vtable >= m.base() && vtable < m.base() + m.size())
        .ok_or(Error::Other("unable to find vtable"))?;

    let mut funcs = Vec::new();
    let mut idx = 0;
    loop {
        debug!(
            "checking vtable func {} ({}) at 0x{:x}",
            idx, initial_module.name, vtable
        );
        //debug!("trying to scan vtable idx of interface {}/{} at vtable=0x{:x} idx={}", iface.module_info.name, iface.name, vtable, idx);

        match scan_vtable_fn(process, interface_manager, vtable, idx) {
            Ok(func) => {
                if let Some(func) = func {
                    //warn!("potential hook found in vtable of interface {}/{} at vtable=0x{:x} idx={} addr=0x{:x}");
                    warn!(
                        "HOOKED: {} ({}) / {:x} {:x}",
                        idx,
                        initial_module.name,
                        initial_module.base(),
                        initial_module.base() + initial_module.size()
                    );

                    funcs.push(Function::new(func.address));
                }
            }
            Err(err) => {
                println!("error scanning vt func: {}", err);
                break;
            }
        }

        idx += 1;
    }

    Ok(funcs)
}
/// Scans the given vtable for potential hooks
Scans the given vtable for potential hooks
Scans the given vtable for potential hooks
pub fn scan_vtable<T: VirtualMemory>(
    process: &mut Win32Process<T>,
    interface_manager: &InterfaceManager,
    vtable: Address,
) -> Result<Vec<Function>> {
    let initial_module = interface_manager
        .modules()
        .iter()
        .find(|m| vtable >= m.base() && vtable < m.base() + m.size())
        .ok_or(Error::Other("unable to find vtable"))?;
    let mut funcs = Vec::new();
    let mut idx = 0;
    loop {
        debug!(
            "checking vtable func {} ({}) at 0x{:x}",
            idx, initial_module.name, vtable
        );
        //debug!("trying to scan vtable idx of interface {}/{} at vtable=0x{:x} idx={}", iface.module_info.name, iface.name, vtable, idx);
        match scan_vtable_fn(process, interface_manager, vtable, idx) {
            Ok(func) => {
                if let Some(func) = func {
                    //warn!("potential hook found in vtable of interface {}/{} at vtable=0x{:x} idx={} addr=0x{:x}");
                    warn!(
                        "HOOKED: {} ({}) / {:x} {:x}",
                        idx,
                        initial_module.name,
                        initial_module.base(),
                        initial_module.base() + initial_module.size()
                    );
                    funcs.push(Function::new(func.address));
                }
            }
            Err(err) => {
                println!("error scanning vt func: {}", err);
                break;
            }
        }
        idx += 1;
    }
    Ok(funcs)
}
pub fn scan_vtable < T : VirtualMemory > ( process : & mut Win32Process < T > , interface_manager : & InterfaceManager , vtable : Address , ) -> Result < Vec < Function > > { let initial_module = interface_manager . modules ( ) . iter ( ) . find ( | m | vtable >= m . base ( ) && vtable < m . base ( ) + m . size ( ) ) . ok_or ( Error :: Other ( " " ) ) ? ; let mut funcs = Vec :: new ( ) ; let mut idx = 0 ; loop { debug ! ( " " idx initial_module name vtable ) ; //debug!("trying to scan vtable idx of interface {}/{} at vtable=0x{:x} idx={}", iface.module_info.name, iface.name, vtable, idx); match scan_vtable_fn ( process , interface_manager , vtable , idx ) { Ok ( func ) => { if let Some ( func ) = func { //warn!("potential hook found in vtable of interface {}/{} at vtable=0x{:x} idx={} addr=0x{:x}"); warn ! ( " " idx initial_module name initial_module base ( ) initial_module base ( ) initial_module size ( ) ) ; funcs . push ( Function :: new ( func . address ) ) ; } } Err ( err ) => { println ! ( " " err ) ; break ; } } idx += 1 ; } Ok ( funcs ) }
Scans the given vtable for potential hooks
Scans the given vtable for potential hooks
process
&mut Win32Process<T>
interface_manager
&InterfaceManager
vtable
Address
process
&mut Win32Process<T>
interface_manager
&InterfaceManager
vtable
Address