## <a href="#stdstring" rel="noopener noreferrer"># std::string</a>

Dynamic strings like std::string can be expensive and may not always be necessary. They can even slow down your code and cause performance problems if used excessively.
It's important to remember that dynamic strings allocate memory on the heap, which is slower than allocating memory on the stack. Plus, dynamic strings can require costly memory reallocations if the string size changes frequently.
On the other hand, stack strings can be a great alternative to dynamic strings in many cases. Stack strings allocate memory on the stack, which is typically faster than heap memory allocations. And since stack strings have a fixed size, there is no need for memory reallocation, which can further improve performance.
To achieve better overall performance, it's essential to avoid creating, deleting, or modifying dynamic strings within your update loop. 

## <a href="#meowhash" rel="noopener noreferrer"># MeowHash</a>
[**MeowHash**](https://github.com/cmuratori/meow_hash/) is a hash library written by [**Casey Muratori**](https://caseymuratori.com/)
its not only user-friendly, but also delivers exceptional performance with consistently low overhead. In fact, performance has never been an issue with this library, even under heavy use.

A useful feature from object oriented languages such as Java and C# is the ability to get the hashcode of strings, which can then be used for equality comparisons, and as an index into hashtables and such. Our StackString creates a hash of the underlying characters upon creation and when the string has been modified.

## <a href="#strlen" rel="noopener noreferrer"># strlen</a>
After conducting some testing, it appears that strlen can be quite expensive in terms of performance. As such, it's generally not recommended to use it in production code, except perhaps for prototyping purposes.

A better alternative is to use a lightweight implementation like **StringLength** below, which can deliver comparable results with significantly less overhead. In most cases, this implementation should be sufficient for your needs, as you're unlikely to need more than what it provides.

```c++
inline fn u64 //fn = static
StringLength(const char* String)
{
 u64 Count = 0;
 while(*String++)
 {
 ++Count;
 }
 return (Count);
}
```

## <a href="#sprintf" rel="noopener noreferrer"># sprintf</a>
sprintf and its cousins are also super expensive, consider using [**stb_sprintf**](https://github.com/nothings/stb/blob/master/stb_sprintf.h) as an alternative as much as possible.

## <a href="#StackString" rel="noopener noreferrer"># StackString</a>

```c++
// we use this as a global scratch buffer for concatenations, copy, etc. 
// to improve performance by not wasting time in allocations.
#define GlobalStringTempBufferSize 8193 // 8192 + 1
global_variable char GlobalStringTempBuffer[GlobalStringTempBufferSize]; 

#if defined(_MSC_VER) && !defined(vsnprintf)
#define vsnprintf _vsnprintf
#endif

u64
FormatStringV(char* buf, u64 buf_size, const char* fmt, va_list args)
{
#ifdef ENGINE_USE_STB_SPRINTF
 u64 w = stbsp_vsnprintf(buf, buf_size, fmt, args);
#else
 u64 w = vsnprintf(buf, buf_size, fmt, args);
#endif
 if(buf == NULL)
 {
 return w;
 }
 if(w == -1 || w >= buf_size)
 {
 w = buf_size - 1;
 }
 buf[w] = 0;
 return w;
}

u64
FormatString(char* buf, u64 buf_size, const char* fmt, ...)
{
 va_list args;
 va_start(args, fmt);
 u64 w = FormatStringV(buf, buf_size, fmt, args);
 va_end(args);
 return w;
}


inline b32
IsPowerOfTwo(u64 x)
{
 return (x & (x - 1)) == 0;
}

template<const u64 Size = 64>
struct stack_string
{
 u64 Hash = 0;
 u64 Length = 0;
 char String[Size] = { 0 };

 stack_string()
 {
 Assert(IsPowerOfTwo(Size)); 
 }

 stack_string(const char* str, ...) : stack_string()
 {
 va_list args;
 va_start(args, str);
 u64 Length = FormatStringV(GlobalStringTempBuffer, GlobalStringTempBufferSize, str, args);
 va_end(args);
 InitFromGlobalTempBuffer(Length);
 }

 void InitFromGlobalTempBuffer(u64 lengthFromArgs)
 {
 Length = lengthFromArgs;
 ZeroMem((u8*) &String[0], Size);
 Assert(Length <= Size);
 //const char *text_end = GlobalStringTempBuffer + Length;
 Length = MathClamp(Length, 0, Size);
 CopyMem(&String[0], (void*) &GlobalStringTempBuffer[0], Length);
 String[Length + 1] = '\0';

 ReHash();
 }

 void ReHash()
 {
 meow_u128 Hash128 = MeowHash(MeowDefaultSeed, Length, (u8*) &String);
 u64 Hash64 = MeowU64From(Hash128, 0);
 this->Hash = Hash64;
 }

 inline b32 IsEmptyOrNull()
 {
 return Length == 0;
 }

 inline operator bool()
 {
 return !IsEmptyOrNull();
 }

 inline bool operator==(stack_string<Size>& str)
 {
 if(Hash == str.Hash)
 {
 return true;
 }
 if(Length != str.Length)
 {
 return false;
 }
 for(u64 i = 0; i < Length; i++)
 {
 if(String[i] != str.String[i])
 {
 return false;
 }
 }
 return true;
 }

 inline bool operator!=(stack_string<Size>& str)
 {
 return !(*this == str);
 }

 inline stack_string<Size>& operator=(const char* str)
 {
 ZeroMem((u8*) &String[0], Size);
 u64 strLength = StringLength(str);
 strLength = MathClamp(strLength, 0, Size); // if the input string is bigger than our Size, we just truncate it
 CopyMem(&String[0], (void*) str, strLength);
 Length = strLength;

 ReHash();
 return *this;
 }

 inline stack_string<Size>& operator=(const stack_string<Size>& str)
 {
 Length = 0;
 while(str.String[Length] && Length < Size)
 {
 String[Length] = str.String[Length];
 Length++;
 }
 ReHash();
 return *this;
 }

 inline stack_string<Size>& operator+=(const char* str)
 {
 while(*str && Length < Size)
 {
 String[Length++] = *str++;
 }
 ReHash();
 return *this;
 }

 inline stack_string<Size>& operator+=(const stack_string<Size>& str)
 {
 for(u64 i = 0; i < str.Length && Length < Size; i++)
 {
 String[Length++] = str.String[i];
 }
 ReHash();
 return *this;
 }

 inline stack_string<Size> operator+(const char* str)
 {
 stack_string<Size> result = *this;
 result += str;
 return result;
 }

 inline stack_string<Size>& operator+(const stack_string<Size>& str)
 {
 stack_string<Size> result = *this;
 result += str;
 ReHash();
 return result;
 }

 inline void ReplaceAll(const char A, const char B)
 {
 for(u64 i = 0; i < Length; i++)
 {
 if(String[i] == A)
 {
 String[i] = B;
 }
 }

 ReHash();
 }

 inline u64 LastIndexOf(const char A) const
 {
 if(Length == 0)
 {
 return 0;
 }
 for(s32 i = Length - 1; i >= 0; i--)
 {
 if(String[i] == A)
 {
 return i;
 }
 }
 return 0;
 }

 inline u64 FirstIndexOf(const char A)
 {
 if(Length == 0)
 {
 return 0;
 }
 for(u64 i = 0; i < Length; i++)
 {
 if(String[i] == A)
 {
 return i;
 }
 }
 return 0;
 }

 inline void SubString(u64 EndIndex)
 {
 Assert(EndIndex <= Length);
 String[EndIndex] = 0;
 ZeroMem((u8*) &String[EndIndex], Size - EndIndex); // Zero Rest
 Length = EndIndex;
 ReHash();
 }

 inline void SubString(u64 StartIndex, u64 EndIndex)
 {
 Assert(EndIndex <= Length);
 Assert(StartIndex <= EndIndex);
 u64 NewLength = EndIndex - StartIndex;
 char* NewString = (char*) &String[StartIndex];
 ZeroMem((u8*) &String[0], Size); // Zero Rest
 CopyMem(&String[0], (void*) NewString, NewLength);
 Length = NewLength;
 ReHash();
 }

 inline void Appendf(const char* str, ...)
 {
 va_list args;
 va_start(args, str);
 u64 w = FormatStringV(GlobalStringTempBuffer, GlobalStringTempBufferSize, str, args);
 va_end(args);

 Assert(Length + w <= Size);
 //const char *text_end = GlobalStringTempBuffer + Length;
 Length = MathClamp(Length + w, 0, Size);
 CopyMem(&String[Length - w], (void*) &GlobalStringTempBuffer[0], w);
 ReHash();
 }

 inline void Append(const char* Str, u64 StrLength)
 {
 Assert(Length + StrLength <= Size);
 Length = MathClamp(Length + StrLength, 0, Size);
 CopyMem(&String[Length - StrLength], (void*) Str, StrLength);
 ReHash();
 }

 void Blit(const char* string, ...)
 {
 va_list args;
 va_start(args, string);
 u64 Length = FormatStringV(GlobalStringTempBuffer, GlobalStringTempBufferSize, string, args);
 va_end(args);
 InitFromGlobalTempBuffer(Length);
 }

 inline struct path_string& ToPathString()
 {
 Assert(Size >= 1024);
 return *(struct path_string*) this;
 }
};

typedef stack_string<32> stack_string_32;
typedef stack_string<64> stack_string_64;
typedef stack_string<128> stack_string_128;
typedef stack_string<256> stack_string_256;
typedef stack_string<512> stack_string_512;
typedef stack_string<1024> stack_string_1024;
typedef stack_string<2048> stack_string_2048;
typedef stack_string<4096> stack_string_4096;
typedef stack_string<8192> stack_string_8192;
```


## <a href="#StackString" rel="noopener noreferrer"># PathString</a>
A common usage of strings is to represent filesystem paths for loading files etc. 


With our stack string defined we can create utility functions for getting relative paths, full paths and even FileType from a path.

```c++
// Path string is just really a stack_string_1024 that has IO functions
struct path_string : stack_string_1024
{
 path_string(stack_string_1024 Relpath) : stack_string_1024(Relpath) { }

 stack_string_1024 GetRelativePath()
 {
 u64 LengthOfWorkingDir = StringLength(ApplicationConstants.WorkingDirectory) + 1;
 stack_string_1024 NewPath(&(this->String)[LengthOfWorkingDir]);
 return NewPath;
 }

 FileType GetType()
 {
 FileType Type = GetFileTypeFromExtension(GetExtension().String);
 if(Type == FileType_Asset)
 {
 FileType AssetType = Asset::PeekFileTypeFromHeaderOnDisk(*this);
 return AssetType;
 }
 return Type;
 }
 stack_string_64 GetExtension()
 {
 return IOPathGetExtensionString(*this);
 }
 stack_string_1024 GetFullPath()
 {
 FileType Type = GetFileTypeFromExtension(GetExtension().String);
 stack_string_1024 FullPath("%s/%s", Type == FileType_Asset ? ApplicationConstants.AssetDirectory : ApplicationConstants.WorkingDirectory, this->String);
 #ifdef ENGINE_WIN32
 FullPath.ReplaceAll('/', '\\');
 #else
 FullPath.ReplaceAll('\\', '/');
 #endif
 return FullPath;
 }

 stack_string_1024 ReplaceExtension(const char* newExtensionString)
 {
 u64 lastIndexOfExtension = LastIndexOf('.');
 SubString(lastIndexOfExtension);
 Appendf(newExtensionString);
 return (stack_string_1024) *this;
 }

 stack_string_1024 GetFileName()
 {
 return IOPathGetFileNameString((*this));
 }
};
```

Stack strings

## <a href="#Idea" rel="noopener noreferrer"># Idea</a>
The main goal is to improve application performance by caching created pipelines. By doing so, we can avoid the need to recreate pipelines when we load the application again. To achieve this, we load a pipeline cache from disk and pass it to the driver, which can then handle pipeline management automatically.

Throughout the lifetime of the application, pipelines are created and automatically deleted by the driver upon application closure. Before deleting any pipelines, it's essential to query the driver to obtain the pipeline cache at that moment, so it can be saved for future use.

Before deleting any pipelines, it's also necessary to query the driver to obtain the pipeline cache at that moment, so that it can be saved for future use.

If you have pipelines loading and unloading frequently, it's necessary to create and save a VkPipelineCache for each state to avoid lengthy pipeline loading times, which can take around 200 ms. In an ideal scenario, minimizing state changes and pipeline shuffling as much as possible can help optimize performance.


## <a href="#VkPipelineCache" rel="noopener noreferrer"># Creating VkPipelineCache</a>
To store the VKPipelineCache variable for later use in vkCreateGraphicsPipelines, it's recommended to create and store the variable in a custom Device class that can be accessed from anywhere within the application. In Tempest, for example, the pipeline cache is created and stored in a custom Device class after the Vulkan device has been created and extensions have been chosen.
```c++
VkPipelineCache m_pipelineCache;
```

Once the Vulkan device has been created and extensions have been chosen, we can proceed to create the Pipeline Cache.

```c
VkPipelineCacheCreateInfo pipelineCache;
pipelineCache.sType = VK_STRUCTURE_TYPE_PIPELINE_CACHE_CREATE_INFO;
pipelineCache.pNext = NULL;
pipelineCache.initialDataSize = Buffer.Size;
pipelineCache.pInitialData = Buffer.Data; //Buffer contains the file buffer from disk
pipelineCache.flags = 0;
VkResult res = vkCreatePipelineCache(m_device, &pipelineCache, NULL, &m_pipelineCache);
assert(res == VK_SUCCESS);
```


In the final release build, it's recommended to focus on creating the PipelineCache and passing it to your vkCreateGraphicsPipelines calls. Depending on your needs, you may not need to store the PipelineCache separately. In such cases, you can embed the PipelineCache as a C++ header and load it as part of your application. Since the pipelines may not dyanmically after a shipped game.

During my initial testing, I worked with approximately 10 actual pipelines and 30 editor-specific pipelines. The resulting size of the pipeline cache was around 1.6 MB.

When I first added pipelines, I loaded the cache during startup and saved it each time the application closed. However, I noticed that the size of the pipeline cache increased with each subsequent write, even without modifying the pipeline cache itself. I suspect that some kind of versioning is being applied on the driver side that appends to the cache.

As such, it's important to keep this in mind and potentially clean up by deleting the pipeline cache and regenerating it prior to shipping the application.


## <a href="#QueryVkPipelineCache" rel="noopener noreferrer"># Querying the driver for the VkPipelineCache</a>


```c++
void
Device::StorePipelineCache()
{
 byte_buffer Buffer;
 vkGetPipelineCacheData(m_device, m_pipelineCache, &Buffer.Size, NULL);
 Buffer.AllocateZeroes(Buffer.Size);
 vkGetPipelineCacheData(m_device, m_pipelineCache, &Buffer.Size, Buffer.Data);
 stack_string_1024 Path("Internal/PipelineCache.bin");
 EngineDeleteFile(Path.ToPathString().GetFullPath().String);
 EngineWriteFile(Path.ToPathString().GetFullPath().String, Buffer.Data, Buffer.Size);
}
```


## <a href="#Embedding" rel="noopener noreferrer"># Embedding the pipeline cache as a C++ Header</a>
Thankfully, we can embed our pipeline cache as a C++ header file. This technique was inspired by [**János Turánszki**](https://twitter.com/turanszkij/status/1637130318867046401).

```c++
std::string
BinaryToCppHeader(byte_buffer& Buffer, stack_string_128& HeaderName)
{
 std::string ss;
 ss += "const u8 ";
 ss += HeaderName.String;
 ss += "[] = {";
 for (u64 i = 0; i < Buffer.Size; i++)
 {
 if (i % 32 == 0)
 {
 ss += "\n";
 }
 ss += std::to_string((u32)Buffer.Data[i]) + ",";
 }
 ss += "\n};\n";
 return ss;
}
```

By embedding the PipelineCache as a C++ header file, we can significantly reduce the time it takes to load the cache, particularly during application startup. This approach eliminates the need for several input/output (IO) operations required to load the PipelineCache from disk before graphics can be displayed.


## <a href="#CreationExample" rel="noopener noreferrer"># Creation Example</a>
The following is a code example and is how Tempest handles this pipeline cache creation.

```c++
...
#include "embeds/PipelineCache/pipeline_cache.cpp" // const u8 embed_pipeline_cache[] = { 32,0,0,0,1,0 ..... }
...
void
Device::CreatePipelineCache()
{
 b32 CacheIsValid = false;
 #ifdef ENGINE_PIPELINE_CACHE_FROM_DISK
 // create pipeline cache
 stack_string_1024 Path("Internal/PipelineCache.bin");
 engine_file File;
 byte_buffer Buffer;
 if (EngineFileExists(Path.ToPathString().GetFullPath().String))
 {
 EngineReadFile(Path.ToPathString().GetFullPath().String, &File);
 Buffer = File.CopyToByteBuffer();
 EngineCloseFile(File);
 if(Buffer.Data)
 {
 VkPipelineCacheHeaderVersionOne* Header = (VkPipelineCacheHeaderVersionOne*) Buffer.Data;
 if(Header->deviceID == m_deviceProperties.deviceID && Header->vendorID == m_deviceProperties.vendorID && memcmp(Header->pipelineCacheUUID, m_deviceProperties.pipelineCacheUUID, VK_UUID_SIZE) == 0)
 {
 CacheIsValid = true;
 } else
 {
 CacheIsValid = false;
 }
 }
 }
 #else
 const_byte_buffer Buffer(embed_pipeline_cache, sizeof(embed_pipeline_cache));

 if(Buffer.Data)
 {
 VkPipelineCacheHeaderVersionOne* Header = (VkPipelineCacheHeaderVersionOne*) Buffer.Data;
 if(Header->deviceID == m_deviceProperties.deviceID && Header->vendorID == m_deviceProperties.vendorID && memcmp(Header->pipelineCacheUUID, m_deviceProperties.pipelineCacheUUID, VK_UUID_SIZE) == 0)
 {
 CacheIsValid = true;
 }
 else
 {
 CacheIsValid = false;
 }
 }

 #endif

 VkPipelineCacheCreateInfo pipelineCache;
 pipelineCache.sType = VK_STRUCTURE_TYPE_PIPELINE_CACHE_CREATE_INFO;
 pipelineCache.pNext = NULL;
 pipelineCache.initialDataSize = CacheIsValid ? Buffer.Size : 0;
 pipelineCache.pInitialData = CacheIsValid ? Buffer.Data : NULL;
 pipelineCache.flags = 0;
 VkResult res = vkCreatePipelineCache(m_device, &pipelineCache, NULL, &m_pipelineCache);
 assert(res == VK_SUCCESS);

 #ifdef ENGINE_PIPELINE_CACHE_FROM_DISK
 Buffer.Destroy();
 #endif
}
```

Speeding up Tempest by Pipeline Caching

I was invited to take part in a jam by [**Coherence.io**](https://coherence.io/) with the lovely [**@andytouch**](https://twitter.com/andytouch) and [**@kal**](https://twitter.com/kalobrien) and we managed to create Duck Planet! 

When creating Duck Planet, we wanted to play music in the background. There is way more to this black box than what you can turn out in 2 days, but sometimes you just need a simple script that does the job well and doesn't take too much time to implement while still fooling you that it is polished.


There is always a challenge when it comes to getting the sound right in video games. A skipped frame is barely noticeable to our eyes, but our ears can detect the tiniest details. Our iscute ears immediately notice a skipped beat or change in song.


To trick our ears we need to gradually lower the volume to near zero, switch the track and bring up the volume. 

```csharp
using DG.Tweening;
using UnityEngine;

public class MusicBrain : MonoBehaviour
{
 [SerializeField] AudioSource _source;
 [SerializeField] AudioClip[] _clips;
 [SerializeField, Range(0, 10)] float _fadeOutDuration = 3.0f;
 [SerializeField, Range(0, 10)] float _fadeInDuration = 3.0f;
 [SerializeField, Range(0, 1)] float _fadeOutCreep = 0.9f; //Start fading out when we've reached 90% of the clip 
 [SerializeField, Range(0, 1)] float _maxVolume = 0.2f; 

 AudioClip GetCurrentClip => _clips[_currentClip];
 int _currentClip = 0;
 float _percentage = 0;

 Sequence _fadeInSeq;
 Sequence _fadeOutSeq;

 void Start()
 {
 //_currentClip = Random.Range(0, _clips.Length);
 _source.clip = GetCurrentClip;
 _source.volume = _maxVolume;
 _source.Play();
 }

 void FixedUpdate()
 {
 _percentage = _source.time / _source.clip.length;

 if (_percentage >= _fadeOutCreep)
 {
 StartFadeOut(() =>
 {
 SetNextTrack();
 StartFadeIn();
 });
 }
 }

 void StartFadeOut(System.Action onDone = null)
 {
 if (_fadeOutSeq == null || !_fadeOutSeq.active)
 {
 _fadeOutSeq = DOTween.Sequence()
 .AppendCallback(() => _source.DOFade(0, _fadeOutDuration))
 .AppendInterval(_fadeOutDuration)
 .AppendCallback(() => onDone?.Invoke())
 .Play();
 }
 }

 void StartFadeIn(System.Action onDone = null)
 {
 if (_fadeInSeq == null || !_fadeInSeq.active)
 {
 _fadeInSeq = DOTween.Sequence()
 .AppendCallback(() => _source.DOFade(_maxVolume, _fadeInDuration))
 .AppendInterval(_fadeInDuration)
 .AppendCallback(() => onDone?.Invoke())
 .Play();
 }
 }

 void SetNextTrack()
 {
 _currentClip++;
 //wrap around
 if (_currentClip > _clips.Length - 1)
 {
 _currentClip = 0;
 }
 _source.clip = _clips[_currentClip];
 _source.Play();
 }
}
```

Quick and dirty music playback in unity

Virtual Method Tables (VMTs) or Virtual Function Tables (VFTs) have become ubiquitous in modern software development due to the prevalence of object-oriented programming practices. These tables are integral to implementing polymorphism in languages like C++.
In this article, we'll explore how VMTs can be manipulated through a process called VMT hooking, discuss the vulnerabilities it exposes, and propose methods to protect programs from such exploits.
There are some limitations to VMT hooking to keep in mind, such as thread safety, reentrancy, or the impact on program stability.

Initially, we'll need to know how the application is structured and if there are any VMT's at all. This can be done with a reverse engineering tools such as IDA Pro, Ghidra, or WinDbg.

#### Understanding VMT Structure and Storage
VMTs are typically stored as the first element of a class or struct. However, the compiler abstracts this placement, storing a pointer to the VMT within the struct. This makes locating and manipulating VMTs a non-trivial task.
To manipulate VMTs, we need to understand their structure and function pointers stored within. VMTs store pointers to virtual functions, which are essentially addresses of these functions in memory.

Consider the following code snippet:

```cpp
struct fruit 
{
 int Calories;
 virtual void PrintCalories() 
 { 
 printf("fruit->Calories: %d\n", Calories);
 }
 virtual void A() 
 {
 printf("A \n");
 }
 virtual void B() 
 {
 printf("B \n");
 }
};

struct apple : fruit
{
 void PrintCalories() override
 {
 printf("apple->Calories: %d\n", Calories);
 }
};
```


In Visual Studio, the VMT is denoted as ```__vfptr```, which can be inspected during debugging sessions.


<center>

![visual studio inspection 1](https://jadderson.com/static/resources/media/blog/vmt_hooking/vmt_hooking_2.png)

</center>

We can clearly see our virtual functions ```PrintCalories```, ```A```, ```B``` in there: 

<center>

![visual studio inspection 2](https://jadderson.com/static/resources/media/blog/vmt_hooking/vmt_hooking_3.png)

</center>

Since the VMT is stored as the first element, Getting the VMT can be done by casting it to a triple pointer and dereferencing it.
The reason why we're storing it as a double pointer is that it's a pointer to a list of memory addresses. Storing it as a double pointer makes accessing much easier as we'll notice later on.
```cpp
void** VirtualFunctionTable = *(void***)&MyFruit;
```

At this point, it would be useful to know how big the Virtual Function Table is. Here's an easy and fast way to retrieve it without calling into windows and querying page sizes: 
```cpp
unsigned long long VMTLength(void** VMT) 
{
 unsigned long long i = 0;
 for (; VMT[i] && VMT[i] < (void *)VMT; i++);
 return i;
}
```

And retrieve the count like so:

```cpp
unsigned long long NumberOfVirtualFunctions = VMTLength(VirtualFunctionTable);
```

#### Getting to the Virtual functions
First, we enumerate the entries in the VMT and store the addresses of the virtual functions:
Recall that the VMT stores pointers to the functions, essentially that means that FuncEntry1 is a pointer to a function.


```cpp
//retrieving the functions:
void* FuncEntry1 = VirtualFunctionTable[0];
void* FuncEntry2 = VirtualFunctionTable[1];
void* FuncEntry3 = VirtualFunctionTable[2];
```


At this point, we could even call the functions directly.
However, there's a caveat; we can't call FuncEntry1 (```PrintCalories```), the reason is that it implicitly requires the 'this' pointer to the base class because we're passing in ```Calories```.
```cpp
printf("fruit->Calories: %d\n", Calories);
```


Implicitly the actual translation is more like this.
```cpp
printf("fruit->Calories: %d\n", this.Calories);
```


But our function does not take any arguments where does it get 'this' pointer from?
The answer is that the compiler puts the pointer in a register or on the stack depending on the [Calling Convention](https://docs.microsoft.com/en-us/cpp/build/reference/gd-gr-gv-gz-calling-convention?view=vs-2019). 
From the documentation: 
*/Gd, the default setting, specifies the __cdecl calling convention for all functions except C++ member functions and functions that are marked __stdcall, __fastcall, or __vectorcall.*
The ```__cdecl``` convention places the 'this' pointer as the last element on the stack.
In our case, the 'this' pointer is pointing to a different place in memory. We could pass the pointer on the stack via inline assembly instructions, but unfortunately, MSVC doesn't support inline assembly instructions on x64 applications. ...


A workaround is to use another calling convention namely the [```__thiscall``` convention](https://docs.microsoft.com/en-us/cpp/cpp/thiscall?view=vs-2019).
We will define the new convention along with a global variable that acts as two things; stores the address of the original virtual function, and so that we can easily invoke it.
```cpp
typedef void(__thiscall* VirtualFunction001)(void* ThisPtr);
VirtualFunction001 GlobalVirtualFunction001 = 0;
```

We can now call FuncEntry1 like so:
```cpp
GlobalVirtualFunction001 = (VirtualFunction001)FuncEntry1;
GlobalVirtualFunction001(&MyFruit); //we'll have to pass in MyFruit such that we have access to MyFruit.Calories.
```

If we instead execute FuncEntry2; it'll work fine without any explicit definition. 
```cpp
((void (*)(void))*FuncEntry2)(); //we know it returns void and takes no arguments.
```

This is the output of both the execution of FuncEntry1 and FuncEntry2.

<center>

![VMT function calling](https://jadderson.com/static/resources/media/blog/vmt_hooking/vmt_hooking_4.png)

</center>


# Hooking 
VMT hooking involves intercepting calls to virtual functions and redirecting them to alternate functions, known as hooks. This can be useful for various purposes, including debugging or adding additional functionality.

Now lets try to hook into FuncEntry1 or ```PrintCalories```. 

First, we need to define the function that'll be the 'Hook'.
We'll use the __fastcall convention since it is the easiest way and requires less code.
For now, all our 'Hook' function does is call into ```printf```.
```cpp
//as specified by https://docs.microsoft.com/en-us/cpp/cpp/fastcall?view=vs-2019
//"The first two DWORD or smaller arguments that are found in the argument list
//from left to right are passed in ECX and EDX registers;
//all other arguments are passed on the stack from right to left."
void __fastcall OurHookFunction(void* ECXRegister, void* EDXRegister)
{
 //that means that the pointer to which "this" operator points to is now stored in the ECS register.
 //and we can retrieve it like so:
 fruit* FruitPtr = (fruit*)ECXRegister;
 //FruitPtr->PrintCalories(); //infinite recursion!
 FruitPtr->A();
 FruitPtr->B();

 printf("Broccoli is not a fruit but a malicious vegetable!\n");

 //Call the original 
 GlobalVirtualFunction001(ECXRegister);
}
``` 
*Notice that we can call the other virtual functions from inside.*


Next, we'll have to make sure to overwrite the protection rights to the memory region by calling VirtualProtect. 
We then save the address of the original Function such that we can restore it later if need be.
Then we can simply place in OurHookFunction in the VMT. Memcpy can also be used for this, and if the address space is in another module, we want to use WriteProcessMemory instead.
Then remember to restore the memory rights.
```cpp
//begin hook
DWORD OldProtectionFlags = 0;
VirtualProtect(&VirtualFunctionTable[0], sizeof(void*), PAGE_EXECUTE_READWRITE, &OldProtectionFlags);

//save the original function
GlobalVirtualFunction001 = (VirtualFunction001)VirtualFunctionTable[0];

//overwrite with our function.
VirtualFunctionTable[0] = &OurHookFunction;
//memcpy(VirtualFunctionTable[0], &OurHookFunction, sizeof(void*));
//WriteProcessMemory if we're hooking outside our address space.
 
//Restore the original page protection
VirtualProtect(&VirtualFunctionTable[0], sizeof(void*), OldProtectionFlags, &OldProtectionFlags);
```


And we have now successfully hooked the VMT with our function.
<center>

![Sucessfull hook.png](https://jadderson.com/static/resources/media/blog/vmt_hooking/vmt_hooking_5.png)

</center>


It is important to realize that there exists one VMT per struct that contains the defined virtual functions, in our case that's the ```fruit``` struct. The VMT is created when the compiler encounters the first instance of the struct being used. That means if we define ```MyFruit``` on the stack, the corresponding VMT will be stored in memory by the compiler, when we then define ```AllocatedAppleFruit``` or ``MyApple``` then both will share the same pointer to the VMT. 
```cpp
 fruit MyFruit;
 apple MyApple;
 fruit* AllocatedAppleFruit = new apple;
```

If we Hook the VMT for ```MyApple``` then ```AllocatedAppleFruit``` will use our hooked function as well, so will MyFruit unless the function is overloaded!
If the function is overloaded a different Function pointer exists to that specific function in the overloaded struct.

Another method is to hook into a sub-function that is being called by our function of interest. E.g. we want to hook into FOO(), but FOO() calls BAR() we can try hooking BAR() instead.



# Detection and Prevention
Detecting VMT tampering can be challenging but can involve actively tracking VMT addresses and function pointers. Additionally, monitoring execution within memory sections can provide indications of tampering.

Another detection method is by checking if the execution occurs in the .data section of the memory instead of the .text section. Since that will give a clear indication that memory has been copied there for execution.

Contrary to popular beliefs VirtualProtect does not work, there are many ways to bypass permissions in windows the most common way is to exploit a vulnerable certified driver by buffer overflows or other bugs. There's a big list of vulnerable certified drivers from reputable brands like Asus and Logitech. A driver will be able to write to protected memory bypassing the permissions of a regular application.

Preventing VMT hooking can be achieved by avoiding the use of virtual functions altogether, as they inherently introduce vulnerabilities. Alternatively, employing techniques such as encryption or obfuscation can make VMT manipulation more difficult for attackers.

There are other ways of achieving polymorphism by simply placing a struct inside a struct. 


# Source Code
The full source code. The Complete project can be found on [Github here](https://github.com/GabrielJadderson/VMT-Hooking).
```cpp
#include <stdio.h>
#include <windows.h>

struct fruit 
{
 int Calories;
 
 virtual void PrintCalories() 
 { 
 printf("fruit->Calories: %d\n", Calories);
 }
 
 virtual void A() 
 {
 printf("A \n");
 }
 
 virtual void B() 
 {
 printf("B \n");
 }
};

struct apple : fruit
{
 void PrintCalories() override
 {
 printf("apple->Calories: %d\n", Calories);
 }
};

unsigned long long VMTLength(void** VMT) {
 unsigned long long i = 0;
 for (; VMT[i] && VMT[i] < (void *)VMT; i++);
 return i;
}

typedef void(__thiscall* VirtualFunction001)(void* ThisPtr);
VirtualFunction001 GlobalVirtualFunction001 = 0;

//as specified by https://docs.microsoft.com/en-us/cpp/cpp/fastcall?view=vs-2019
//"The first two DWORD or smaller arguments that are found in the argument list
//from left to right are passed in ECX and EDX registers;
//all other arguments are passed on the stack from right to left."
void __fastcall OurHookFunction(void* ECXRegister, void* EDXRegister)
{
 //that means that the pointer to which "this" operator points to is now stored in the ECS register.
 //and we can retrieve it like so:
 fruit* FruitPtr = (fruit*)ECXRegister;
 //FruitPtr->PrintCalories(); //infinite recursion!
 FruitPtr->A();
 FruitPtr->B();

 printf("Broccoli is not a fruit but a malicious vegetable!\n");

 //Call the original 
 GlobalVirtualFunction001(ECXRegister);
}

void __fastcall VMTHookFnc(void* pEcx, void* pEdx)
{
 fruit* pThisPtr = (fruit*)pEcx;

 printf("In VMTHookFnc\n");
}

void Test(fruit* fruit)
{
 fruit->PrintCalories();
 fruit->A();
 fruit->B();
}


int main() 
{
 fruit MyFruit;
 MyFruit.Calories = 0;

 apple MyApple;
 MyApple.Calories = 52;

 fruit* AllocatedAppleFruit = new apple;
 AllocatedAppleFruit->Calories = 42;
 
 Test(&MyFruit);

 printf("\n\n");

 
 void** VirtualFunctionTable = *(void***)&MyFruit;
 unsigned long long NumberOfVirtualFunctions = VMTLength(VirtualFunctionTable);

 //retrieving the functions:
 void* FuncEntry1 = VirtualFunctionTable[0];
 void* FuncEntry2 = VirtualFunctionTable[1];
 void* FuncEntry3 = VirtualFunctionTable[2];

 //Call FuncEntry1 directly
 GlobalVirtualFunction001 = (VirtualFunction001)FuncEntry1;
 GlobalVirtualFunction001(&MyFruit); //we'll have to pass in MyFruit such that we have access to MyFruit.Calories.

 ((void (*)(void))FuncEntry2)(); //we know it returns void and takes no arguments.

 
 //begin hook
 DWORD OldProtectionFlags = 0;
 VirtualProtect(&VirtualFunctionTable[0], sizeof(void*), PAGE_EXECUTE_READWRITE, &OldProtectionFlags);

 //save the original function
 GlobalVirtualFunction001 = (VirtualFunction001)VirtualFunctionTable[0];

 //overwrite with our function.
 VirtualFunctionTable[0] = &OurHookFunction;
 //memcpy(VirtualFunctionTable[0], &OurHookFunction, sizeof(void*));
 //WriteProcessMemory if we're hooking outside our address space.
 
 //Restore the original page protection
 VirtualProtect(&VirtualFunctionTable[0], sizeof(void*), OldProtectionFlags, &OldProtectionFlags);
 
 Test(&MyFruit);
 Test(&MyApple);
 Test(AllocatedAppleFruit);
 
 return 0;
}
```

An overview of VMT hooking exploitation and mitigation techniques.

VMT hooking

Some of my experiments with procedural generation.

I created a root prefab called Terrain which has a FloorTerrain script.
On initialization we'll generate several planes from the center of the Terrain object.

To achieve this we'll have to create a root prefab; Which I've called Terrain.


Things we need to know is the location of the Player at every frame and which entity/prefab we'll have to create when the player reaches the edge.

On initialization we create the starting platform like so:

```csharp
//create the starting platform
for (int x = -halfTilesX; x < halfTilesX; x++)
{
 for (int z = -halfTilesZ; z < halfTilesZ; z++)
 {
 Vector3 pos = new Vector3((x * planeSize + startPos.x), 0, (z * planeSize + startPos.z));
 GameObject t = (GameObject)Instantiate(tilePrefab, pos, Quaternion.identity);
 tileName = "Tile_" + ((int)(pos.x)).ToString() + "_" + ((int)(pos.z)).ToString();
 t.GetComponent<Floor>().Init(pos, chunkSize, tileName, ft);
 tile = new Tile(t, updateTime);
 tiles.Add(tileName, tile);
 }
}
```


Here I am assuming that the Y-axis is up instead of Z. All we're doing is generating a 2D grid of Tiles these tiles are just regular planes, which is an equilateral square. Once we've calculated the position of the plane we'll add the Floor script to it and initialize it then we'll add it to a HashTable. 
Which happens here:

```csharp
string tileName = "Tile_" + ((int)(pos.x)).ToString() + "_" + ((int)(pos.z)).ToString();
tiles.Add(tileName, tile);
```

This is not ideal and you don't want to use a Hashmap here at all, even though the lookup is in constant time on average. You should instead try to use an array that contains larger chunks of terrain and inside each chunk is a subdivision of smaller terrain planes. The indices of each plane can then be calculated based on the position of the player, how big the chunk dimension is and how many chunks and planes there are.
[Casey Muratori does an amazing job at explaining how this is done in his Handmade Hero game engine series](https://www.youtube.com/watch?v=lDp4rqcigZs). When I wrote this I had no idea how easy it was and ended up using a Hashtable because that's always the easy solution. 

# Main logic
For the main logic, this is what we do in FixedUpdate:
```csharp
private void FixedUpdate() 
{
 //determine how far the player has moved since last terrain update
 int xMove = (int)(player.transform.position.x - startPos.x);
 int zMove = (int)(player.transform.position.z - startPos.z);
 if (Mathf.Abs(xMove) >= planeSize || Mathf.Abs(zMove) >= planeSize)
 {
 float updateTime = Time.realtimeSinceStartup;

 //force integer position and round to nearest tilesize
 int playerX = (int)(Mathf.RoundToInt(player.transform.position.x / planeSize) * planeSize);
 int playerZ = (int)(Mathf.RoundToInt(player.transform.position.z / planeSize) * planeSize);

 for (int x = -halfTilesX; x < halfTilesX; x++)
 {
 for (int z = -halfTilesZ; z < halfTilesZ; z++)
 {
 Vector3 pos = new Vector3((x * planeSize + playerX), 0, (z * planeSize + playerZ));

 string tilename = "Tile_" + ((int)(pos.x)).ToString() + "_" + ((int)(pos.z)).ToString();

 if (!tiles.ContainsKey(tilename))
 {
 GameObject t = (GameObject)Instantiate(tilePrefab, pos, Quaternion.identity);
 t.GetComponent<Floor>().Init(pos, chunkSize, tilename, ft);
 Tile tile = new Tile(t, updateTime);
 tiles.Add(tilename, tile);
 }
 }
 }
 startPos = player.transform.position;
 }
}
```

The above code triggers when the player moves and thus, we don't have to do extra work when the player is standing still. We round down the nearest player position which is important. Then we'll generate terrain around the player whilst checking that we're not generating duplicates. We do that by a lookup to the hashtable.

The important thing to note here is that because we're just generating new GameObjects on the fly when we need them as opposed to a predefined size, and because we're storing them in a hashmap this gives us sparseness for very little code. 

# Procedurally creating the terrain
For procedural work, it's important to mark the mesh as dynamic. This allows unity to do some optimizations in the background and prevents unity from using static buffers. 
```csharp
terrainMeshFilter.mesh.MarkDynamic();
```
However, since we're generating Terrain and not changing the vertices of the terrain afterwards, we don't have to worry about marking it as Dynamic. Instead, in this case, it would be far better not to. 

This is the entire tile creation routine:
```csharp
private void createFloorTile(Vector3 CenterPosition, float chunkSize, FloorTerrain ft)
{
 Vertices.Add(new Vector3(CenterPosition.x - chunkSize, CenterPosition.y, CenterPosition.z + chunkSize)); //0
 Vertices.Add(new Vector3(CenterPosition.x + chunkSize, CenterPosition.y, CenterPosition.z + chunkSize)); //1
 Vertices.Add(new Vector3(CenterPosition.x, CenterPosition.y, CenterPosition.z)); //2
 Vertices.Add(new Vector3(CenterPosition.x - chunkSize, CenterPosition.y, CenterPosition.z - chunkSize)); //3
 Vertices.Add(new Vector3(CenterPosition.x + chunkSize, CenterPosition.y, CenterPosition.z - chunkSize)); //4

 Normals.Add(Vector3.up); //0
 Normals.Add(Vector3.up); //1
 Normals.Add(Vector3.up); //2
 Normals.Add(Vector3.up); //3
 Normals.Add(Vector3.up); //4

 Triangles.Add(2);
 Triangles.Add(0);
 Triangles.Add(1);

 Triangles.Add(1);
 Triangles.Add(4);
 Triangles.Add(2);

 Triangles.Add(4);
 Triangles.Add(3);
 Triangles.Add(2);

 Triangles.Add(3);
 Triangles.Add(0);
 Triangles.Add(2);

 UVs.Add(new Vector2(0, 1));
 UVs.Add(new Vector2(1, 1));
 UVs.Add(new Vector2(0.5f, 0.5f));
 UVs.Add(new Vector2(0, 0));
 UVs.Add(new Vector2(1, 0));

 //ADD RANDOM COLOR
 //Gradient gradient = RandomE.gradientHSV;
 var noiseOffset = new Vector2(Random.Range(0f, 100f), Random.Range(0f, 100f));
 ft.floorContainer.floorColors.Clear();
 
	float noiseScale = 0.15f;
 float noise = 0f;

 foreach (Vector3 vertex in Vertices)
 {
 float x = noiseScale * vertex.x / 2 + noiseOffset.x;
 float y = noiseScale * vertex.z / 2 + noiseOffset.y;
 noise = Mathf.PerlinNoise(x, y);
 Colors.Add(ft.floorGradient.Evaluate(noise));
 }

 for (int i = 0; i < Vertices.Count; i++)
 {
 Vertices[i] = new Vector3(Vertices[i].x, Mathf.PerlinNoise((CenterPosition.x + transform.position.x) / detailScale, (CenterPosition.z + transform.position.z) / detailScale) * heightScale, Vertices[i].z);
 }

 ft.gameCenteredFloors.Add(CenterPosition, this);

 flush(ft);
}
```
CenterPosition is the coordinate we want to place the Tile at. ChunkSize is how big the tile is, I've set this to 1 meter. First, we create the vertices, assign the triangles (Unity uses a clockwise winding order for the triangles). We then generate the UVs and generate a random gradient sampling from a predefined gradient LUT:

<center>

![gradient lut](https://jadderson.com/static/resources/media/blog/pcg/gradient_lut.webp)

</center>

This is the result:

<center>

<video poster="https://jadderson.com/static/resources/media/blog/pcg/pcg-2_thumbnail.png" width="720" controls autoplay loop muted playsinline preload="auto">
 <source src="https://jadderson.com/static/resources/media/blog/pcg/pcg-2.webm" type="video/webm"></source>
 <source src="https://jadderson.com/static/resources/media/blog/pcg/pcg-2.mp4" type="video/mp4"></source>
 <source src="https://jadderson.com/static/resources/media/blog/pcg/pcg-2.mov" type="video/mov"></source>
</video>

</center>


For the edges and we can simply generate rectangles and place them on top with an offset. We also know the side length of each tile and can easily create oblong rectangles that span the entire side of the tile.

Another approach would be to procedurally generate the edges as well, which would be the optimal strategy. The challenges there would be to calculate the correct placement of each edge such that center-tiles won't have edges and edge-tiles would. This requires a numbering system of each tile in the chunk. There is more work involved, but in terms of performance, that's the best choice. 

Doing all of that, this is the result: 


<center>

<video poster="https://jadderson.com/static/resources/media/blog/pcg/pcg-1_thumbnail.png" width="720" controls autoplay loop muted playsinline preload="auto">
 <source src="https://jadderson.com/static/resources/media/blog/pcg/pcg-1.webm" type="video/webm"></source>
 <source src="https://jadderson.com/static/resources/media/blog/pcg/pcg-1.mp4" type="video/mp4"></source>
 <source src="https://jadderson.com/static/resources/media/blog/pcg/pcg-1.mov" type="video/mov"></source>
</video>

</center>


# Optimizations
I ran into optimization problems early on when doing this.
Because creating a ton of planes and rendering them one by one is never as efficient as rendering a single big geometry all at once. I had the idea to try to combine the meshes like so:
```csharp
public void OptimizeAndCombine()
{
 MeshFilter[] meshFilters = GetComponentsInChildren<MeshFilter>();
 CombineInstance[] combine = new CombineInstance[meshFilters.Length];
 int i = 0;
 while (i < meshFilters.Length)
 {
 combine[i].mesh = meshFilters[i].mesh;
 combine[i].transform = meshFilters[i].transform.localToWorldMatrix;
 meshFilters[i].gameObject.SetActive(false);
 if (meshFilters[i] != terrainMeshFilter)
 {
 unusedFloors.Add(meshFilters[i].gameObject);
 }
 i++;
 }
 terrainMeshFilter.mesh = new Mesh();
 terrainMeshFilter.mesh.CombineMeshes(combine, true);
 terrainMeshFilter.mesh.RecalculateBounds();
 terrainMeshCollider.sharedMesh = terrainMeshFilter.mesh;
 transform.gameObject.SetActive(true);
 removeUnwantedFloors();
 //groundDecoration.OptimizeAndCombineRocks();
}
```
This worked great and i did achieve significant fps speedups and less drawcalls. However, it's not a great solution and I wish I had more access to the Unity rendering API to have abit more control and optimize it further.

I then added some post-processing effect to the camera along with screen space antialiasing, and managed to capture this: 

<center>

<video poster="https://jadderson.com/static/resources/media/blog/pcg/pcg-overview_thumbnail.png" width="720" controls autoplay loop muted playsinline preload="auto">
 <source src="https://jadderson.com/static/resources/media/blog/pcg/pcg-overview.webm" type="video/webm"></source>
 <source src="https://jadderson.com/static/resources/media/blog/pcg/pcg-overview.mp4" type="video/mp4"></source>
 <source src="https://jadderson.com/static/resources/media/blog/pcg/pcg-overview.mov" type="video/mov"></source>
</video>

</center>