0

I've been trying to detour a nullsub, this function is used with log purposes, but as the program is compiled under release flags it got removed and I'd like to restore it.

IDA reports as follow:

.text:004BAC10 ; void __thiscall nullsub_2(void *)
.text:004BAC10 nullsub_2       proc near       
.text:004BAC10                 retn
.text:004BAC10 nullsub_2       endp

My attempt is to detour this address with my own log function, but Microsoft Detours 3.0 throws ERROR_INVALID_BLOCK

I think I get this error as it does not have space to place the jump function, and I don't have any idea how I can fix it.

2
0

Based on http://pastebin.com/qDMP0yz0, you have enough space to make this work.

The easiest solution is to patch your target executable such that the data from Virtual Address 0x004BAC10 through 0x004BAC1E is all nops (0x90 bytes), and patch in a retn (0xC3 byte) at Virtual Address 0x004BAC1F.

You'll then be able to detour the function with Microsoft Detours.

If patching the EXE isn't an option, let us know and I can look at Detours to suggest what needs to be changed in the Detours library itself.

1
  • The solution worked like a charm! Thank's 😊
    – ernilos
    Feb 11 '16 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.