Overriding C++ virtual functions at run time (opens in new tab)

Not sure what you are trying to show, the object still has a vtable and is placed as the first member (and in your example, only) of the class, so that quote is correct.

Obviously if you enable optimizations and one of those optimizations is avoiding the virtual call when the compiler thinks it isn't necessary, then sure you wont get a virtual call everywhere.

But if your code is relying on implementation assumptions like having a vtable at the start of a class, then it should also make sure that this assumption holds by not trying to work around it (e.g. via final) and using compiler options that control that optimization (e.g. GCC has -fno-devirtualize).

It doesn't make much sense to both try and take advantage of implementation details and work against taking advantage of implementation details at the same time.

Cool. Is this due to "final" and the fact that the compiler can figure out the target at compile time?

Patching the GOT doesn't work for internal function calls, though.

Patching function pointers in general is very desirable thing to be able to do when writing these kinds of things. vtables are interesting because unlike normal C function pointers they can only be used in a standards-compliant manner in a few very limited ways, so if you’re implementing control flow verification you can really ratchet up the security for these. For normal C function pointers, sadly, the best you can do is usually very little, if anything at all. Especially because the use of non-compliant constructs like forging ordinary function pointers is extremely common in things like language runtimes.

Are you willing to share any info on how you got stuck with this project, and what this "codebase" was? Can you call it a codebase is it doesn't have source code?

In Java, you can write an agent and intercept when the bytecode for a class is loaded by the JVM by the Class Loader.

ASM is just a bytecode reader/writer/visitor library that can then modify it. You could also just do it statically by having the bytecode you want injected ready to go in an array or resource.

   if (className.equals("a/b/c/d$e"))
       return fixedClassBytecode;
   else
       return bytecode;

It's possible to create custom loaders (e.g., loading a class from an encrypted zip-file, or one that creates custom bytecode on the fly) and things which are trying to obfuscate what they're doing will have custom loaders, but this is a choke point that every class that's read in and instantiated must pass through.

So, is it possible? I get the impression you can create a new class using a bytecode-manipulation library, but that's not the same as modifying an existing class at runtime.

I believe classes, once loaded by the JVM, cannot be changed. https://stackoverflow.com/a/43653466/

And this is why despite trying real hard several times, they couldn't remove Autolisp completely...