I am trying to read the arguments sent to an external dll file "FlashToolLib.dll". My hook function is never triggered, I am guessing because I have the address wrong. I have tried the address in both the dll, and the exe


 public FlashTool_Connect_BROM_ByName
.text:5F866580 FlashTool_Connect_BROM_ByName proc near
.text:5F866580 var_B4          = dword ptr -0B4h
.text:5F866580 var_B0          = dword ptr -0B0h
.text:5F866580 var_AC          = dword ptr -0ACh
.text:5F866580 var_A8          = dword ptr -0A8h
.text:5F866580 var_A4          = dword ptr -0A4h
.text:5F866580 var_A0          = dword ptr -0A0h
.text:5F866580 var_9C          = dword ptr -9Ch
.text:5F866580 var_98          = dword ptr -98h
.text:5F866580 var_94          = dword ptr -94h
.text:5F866580 var_84          = dword ptr -84h
.text:5F866580 var_80          = dword ptr -80h
.text:5F866580 var_7C          = dword ptr -7Ch
.text:5F866580 var_78          = dword ptr -78h
.text:5F866580 var_68          = dword ptr -68h
.text:5F866580 var_64          = dword ptr -64h
.text:5F866580 var_60          = dword ptr -60h
.text:5F866580 var_5C          = dword ptr -5Ch
.text:5F866580 var_4C          = dword ptr -4Ch
.text:5F866580 var_48          = dword ptr -48h
.text:5F866580 var_44          = dword ptr -44h
.text:5F866580 var_40          = dword ptr -40h
.text:5F866580 var_30          = dword ptr -30h
.text:5F866580 var_2C          = dword ptr -2Ch
.text:5F866580 var_28          = dword ptr -28h
.text:5F866580 var_4           = dword ptr -4
.text:5F866580 arg_0           = dword ptr  8
.text:5F866580 arg_4           = dword ptr  0Ch
.text:5F866580 arg_8           = dword ptr  10h
.text:5F866580 arg_C           = dword ptr  14h
.text:5F866580 arg_10          = dword ptr  18h


    #include "stdafx.h"
#include <iostream>
#include <detours.h>
#include <Windows.h>

void hookedFunc(DWORD arg1, DWORD arg2, DWORD arg3, DWORD arg4, DWORD arg5) {

    //Msgbox - arg 1//////////////////////////////////////////////////////////////////////////////
    WCHAR szTest[10]; // WCHAR is the same as wchar_t
                      // swprintf_s is the same as sprintf_s for wide characters
    swprintf_s(szTest, 10, L"%d", arg1); // use L"" prefix for wide chars
    MessageBox(NULL, szTest, L"TEST", MB_OK); // a messageboy example again L as prefix

    std::cout << "original function: argument1 = " << arg1 << std::endl; //print argument
    std::cout << "original function: argument2 = " << arg2 << std::endl; //print argument
    std::cout << "original function: argument3 = " << arg3 << std::endl; //print argument
    std::cout << "original function: argument4 = " << arg4 << std::endl; //print argument
    std::cout << "original function: argument5 = " << arg5 << std::endl; //print argument


BOOL APIENTRY DllMain(HANDLE hModule, DWORD dwReason, LPVOID lpReserved)
    HMODULE FlashToolLib = GetModuleHandleA("FlashToolLib.dll");
    LPVOID fConnect = (LPVOID)GetProcAddress(FlashToolLib, "FlashTool_Connect_BROM_ByName");

    switch (dwReason)


        MessageBox(NULL, L"We are in.", L"Injection Success.", MB_OK);

    return TRUE;
  • avoid using absolute addresses like 4axxxxx unless you are 120℅ sure that the modules in question will always load at the same base address
    – blabb
    Oct 14, 2016 at 3:40
  • What would the alternative be? Oct 14, 2016 at 3:48
  • have you tried to detour any other function? It might be that the one that you hooked was called before your DLL was loaded, and then never called again. Oct 14, 2016 at 17:59
  • I couldn't find docs on the DetourAttach function but I think you're using it incorrectly. See this. Maybe try with DetourAttach((PVOID*) &fConnect, (PVOID) hookedFunc)?
    – Martin
    Oct 14, 2016 at 20:49
  • Apart from that, have you tried checking what's at the function's offset with a memory viewer, right after hooking, to check if it was done properly? Have you tried putting a breakpoint on the function to check if it gets called at all?
    – Martin
    Oct 14, 2016 at 21:02

1 Answer 1


Searched the local drive for an unknown binary that uses a dll
found calc.exe from gnuwin32 it uses 2 dlls calc2.dll and readline5.dll

copied all 3 of them to a test directory

e:\GNUWIN32\bin>cp -v calc.exe calc2.dll readline5.dll e:\test\detours\.
`calc.exe' -> `e:\\test\\detours\\./calc.exe'
`calc2.dll' -> `e:\\test\\detours\\./calc2.dll'
`readline5.dll' -> `e:\\test\\detours\\./readline5.dll'

wrote a small idc script to dump an arbitrary function

e:\test\detours>cat temp.idc
#include <idc.idc>
static main(void)
  auto fp;
  fp = fopen("bla.lst","w");

executed idafree to make a lst file

idag.exe -B -Stemp.idc calc2.dll

found the RVA of an arbitrary Function

e:\test\detours>grep -i imagebase bla.lst
.text:68D41000 ; Imagebase   : 68D40000

e:\test\detours>grep -i export.*zcmp bla.lst
.text:68DC1440 ; Exported entry 791. zcmp
.text:68DC1E10 ; Exported entry 792. zcmpmod

e:\test\detours>set /a 0x68dc1440-0x68d40000

made a simple poc using the rva

//compiled and linked with enterprise wdk using
//cl /LD /W4 /Ox /Zi /analyze /EHsc d2r.cpp /link /DEBUG /RELEASE %linklibs% /EXPORT:DFunc
#include <windows.h>
#include <stdio.h>
#include "include\detours.h"
#pragma comment (lib , "lib\\detours.lib")
typedef void (__cdecl *SomeFunction)(int,int,int,int,int,int);
void  __cdecl DFunc(int i,int j,int k,int l,int m,int n);
SomeFunction Func2Detour = (SomeFunction)((DWORD)GetModuleHandle("calc2.dll") + 529472 );
void  __cdecl DFunc(int i,int j,int k,int l,int m,int n) {
  int x = 0;
  printf("Arg %2d = 0x%08x\t0x%08x\n" , x++,i,*(int*)i);
  printf("Arg %2d = 0x%08x\n" , x++, j);
  printf("Arg %2d = 0x%08x\n" , x++, k);
  printf("Arg %2d = 0x%08x\t0x%08x\n" , x++,l,*(int *)l);
  printf("Arg %2d = 0x%08x\n" , x++, m);
  printf("Arg %2d = 0x%08x\n" , x++, n);
  if (Reason == DLL_PROCESS_ATTACH ){
    DetourAttach(&(PVOID&)Func2Detour, DFunc);
  return TRUE;

compiled and linked as commented in source above

Microsoft (R) C/C++ Optimizing Compiler Version 19.00.23506 for x86
Copyright (C) Microsoft Corporation.  All rights reserved.

Microsoft (R) Incremental Linker Version 14.00.23506.0
Copyright (C) Microsoft Corporation.  All rights reserved.

   Creating library d2r.lib and object d2r.exp

injected the dll with withdll.exe from detours sample

e:\test\detours>e:\detour\bin.X86\withdll.exe /d:d2r.dll .\calc.exe
withdll.exe: Starting: `.\calc.exe'
withdll.exe:   with `e:\test\detours\d2r.dll'
C-style arbitrary precision calculator (version
Calc is open software. For license details type:  help copyright
[Type "exit" to exit, or "help" for help.]


the detour dumps all the six arguments

; 2+2
Arg  0 = 0x0134b750     0x00000002
Arg  1 = 0x00000001
Arg  2 = 0x00000000
Arg  3 = 0x68de11f4     0x00000002
Arg  4 = 0x00000001
Arg  5 = 0x00000000
; 45^89
; 4^8
Arg  0 = 0x0134b7f8     0x00000004
Arg  1 = 0x00000001
Arg  2 = 0x00000000
Arg  3 = 0x68de11fc     0x00000004
Arg  4 = 0x00000001
Arg  5 = 0x00000000
; 4.5^8
Arg  0 = 0x0134b828     0x0000002d
Arg  1 = 0x00000001
Arg  2 = 0x00000000
Arg  3 = 0x0134dab8     0x0000000a
Arg  4 = 0x00000001
Arg  5 = 0x00000000
; 3&5
Arg  0 = 0x0134b828     0x00000003
Arg  1 = 0x00000001
Arg  2 = 0x00000000
Arg  3 = 0x68de11f8     0x00000003
Arg  4 = 0x00000001
Arg  5 = 0x00000000

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.