0

I am trying to read the arguments sent to an external dll file "FlashToolLib.dll". My hook function is never triggered, I am guessing because I have the address wrong. I have tried the address in both the dll, and the exe

FUNCTION:

 public FlashTool_Connect_BROM_ByName
.text:5F866580 FlashTool_Connect_BROM_ByName proc near
.text:5F866580
.text:5F866580 var_B4          = dword ptr -0B4h
.text:5F866580 var_B0          = dword ptr -0B0h
.text:5F866580 var_AC          = dword ptr -0ACh
.text:5F866580 var_A8          = dword ptr -0A8h
.text:5F866580 var_A4          = dword ptr -0A4h
.text:5F866580 var_A0          = dword ptr -0A0h
.text:5F866580 var_9C          = dword ptr -9Ch
.text:5F866580 var_98          = dword ptr -98h
.text:5F866580 var_94          = dword ptr -94h
.text:5F866580 var_84          = dword ptr -84h
.text:5F866580 var_80          = dword ptr -80h
.text:5F866580 var_7C          = dword ptr -7Ch
.text:5F866580 var_78          = dword ptr -78h
.text:5F866580 var_68          = dword ptr -68h
.text:5F866580 var_64          = dword ptr -64h
.text:5F866580 var_60          = dword ptr -60h
.text:5F866580 var_5C          = dword ptr -5Ch
.text:5F866580 var_4C          = dword ptr -4Ch
.text:5F866580 var_48          = dword ptr -48h
.text:5F866580 var_44          = dword ptr -44h
.text:5F866580 var_40          = dword ptr -40h
.text:5F866580 var_30          = dword ptr -30h
.text:5F866580 var_2C          = dword ptr -2Ch
.text:5F866580 var_28          = dword ptr -28h
.text:5F866580 var_4           = dword ptr -4
.text:5F866580 arg_0           = dword ptr  8
.text:5F866580 arg_4           = dword ptr  0Ch
.text:5F866580 arg_8           = dword ptr  10h
.text:5F866580 arg_C           = dword ptr  14h
.text:5F866580 arg_10          = dword ptr  18h

MY C++ CODE:

    #include "stdafx.h"
#include <iostream>
#include <detours.h>
#include <Windows.h>


void hookedFunc(DWORD arg1, DWORD arg2, DWORD arg3, DWORD arg4, DWORD arg5) {


    //Msgbox - arg 1//////////////////////////////////////////////////////////////////////////////
    WCHAR szTest[10]; // WCHAR is the same as wchar_t
                      // swprintf_s is the same as sprintf_s for wide characters
    swprintf_s(szTest, 10, L"%d", arg1); // use L"" prefix for wide chars
    MessageBox(NULL, szTest, L"TEST", MB_OK); // a messageboy example again L as prefix
    /////////////////////////////////////////////////////////////////////////////////////////////

    std::cout << "original function: argument1 = " << arg1 << std::endl; //print argument
    std::cout << "original function: argument2 = " << arg2 << std::endl; //print argument
    std::cout << "original function: argument3 = " << arg3 << std::endl; //print argument
    std::cout << "original function: argument4 = " << arg4 << std::endl; //print argument
    std::cout << "original function: argument5 = " << arg5 << std::endl; //print argument

}



BOOL APIENTRY DllMain(HANDLE hModule, DWORD dwReason, LPVOID lpReserved)
{
    HMODULE FlashToolLib = GetModuleHandleA("FlashToolLib.dll");
    LPVOID fConnect = (LPVOID)GetProcAddress(FlashToolLib, "FlashTool_Connect_BROM_ByName");


    switch (dwReason)
    {


    case DLL_PROCESS_ATTACH:


        MessageBox(NULL, L"We are in.", L"Injection Success.", MB_OK);
        DetourTransactionBegin();
        DetourAttach((PVOID*)fConnect,(PVOID)hookedFunc);
        DetourTransactionCommit();

    }
    return TRUE;
}
  • avoid using absolute addresses like 4axxxxx unless you are 120℅ sure that the modules in question will always load at the same base address – blabb Oct 14 '16 at 3:40
  • What would the alternative be? – user1698144 Oct 14 '16 at 3:48
  • have you tried to detour any other function? It might be that the one that you hooked was called before your DLL was loaded, and then never called again. – peter ferrie Oct 14 '16 at 17:59
  • I couldn't find docs on the DetourAttach function but I think you're using it incorrectly. See this. Maybe try with DetourAttach((PVOID*) &fConnect, (PVOID) hookedFunc)? – Martin Oct 14 '16 at 20:49
  • Apart from that, have you tried checking what's at the function's offset with a memory viewer, right after hooking, to check if it was done properly? Have you tried putting a breakpoint on the function to check if it gets called at all? – Martin Oct 14 '16 at 21:02
1

Searched the local drive for an unknown binary that uses a dll
found calc.exe from gnuwin32 it uses 2 dlls calc2.dll and readline5.dll

copied all 3 of them to a test directory

e:\GNUWIN32\bin>cp -v calc.exe calc2.dll readline5.dll e:\test\detours\.
`calc.exe' -> `e:\\test\\detours\\./calc.exe'
`calc2.dll' -> `e:\\test\\detours\\./calc2.dll'
`readline5.dll' -> `e:\\test\\detours\\./readline5.dll'

wrote a small idc script to dump an arbitrary function

e:\test\detours>cat temp.idc
#include <idc.idc>
static main(void)
{
  auto fp;
  fp = fopen("bla.lst","w");
  GenerateFile(OFILE_LST,fp,MinEA(),MaxEA(),0x0);
  fclose(fp);
  Exit(2);
}

executed idafree to make a lst file

idag.exe -B -Stemp.idc calc2.dll

found the RVA of an arbitrary Function

e:\test\detours>grep -i imagebase bla.lst
.text:68D41000 ; Imagebase   : 68D40000

e:\test\detours>grep -i export.*zcmp bla.lst
.text:68DC1440 ; Exported entry 791. zcmp
.text:68DC1E10 ; Exported entry 792. zcmpmod

e:\test\detours>set /a 0x68dc1440-0x68d40000
529472

made a simple poc using the rva

//compiled and linked with enterprise wdk using
//cl /LD /W4 /Ox /Zi /analyze /EHsc d2r.cpp /link /DEBUG /RELEASE %linklibs% /EXPORT:DFunc
#include <windows.h>
#include <stdio.h>
#include "include\detours.h"
#pragma comment (lib , "lib\\detours.lib")
typedef void (__cdecl *SomeFunction)(int,int,int,int,int,int);
void  __cdecl DFunc(int i,int j,int k,int l,int m,int n);
SomeFunction Func2Detour = (SomeFunction)((DWORD)GetModuleHandle("calc2.dll") + 529472 );
void  __cdecl DFunc(int i,int j,int k,int l,int m,int n) {
  int x = 0;
  printf("Arg %2d = 0x%08x\t0x%08x\n" , x++,i,*(int*)i);
  printf("Arg %2d = 0x%08x\n" , x++, j);
  printf("Arg %2d = 0x%08x\n" , x++, k);
  printf("Arg %2d = 0x%08x\t0x%08x\n" , x++,l,*(int *)l);
  printf("Arg %2d = 0x%08x\n" , x++, m);
  printf("Arg %2d = 0x%08x\n" , x++, n);
  Func2Detour(i,j,k,l,m,n);
}
INT APIENTRY DllMain(HMODULE,DWORD Reason,LPVOID) {
  if (Reason == DLL_PROCESS_ATTACH ){
    DetourTransactionBegin();
    DetourUpdateThread(GetCurrentThread());
    DetourAttach(&(PVOID&)Func2Detour, DFunc);
    DetourTransactionCommit();
  }
  return TRUE;
}

compiled and linked as commented in source above

Microsoft (R) C/C++ Optimizing Compiler Version 19.00.23506 for x86
Copyright (C) Microsoft Corporation.  All rights reserved.

d2r.cpp
Microsoft (R) Incremental Linker Version 14.00.23506.0
Copyright (C) Microsoft Corporation.  All rights reserved.

/out:d2r.dll
/dll
/implib:d2r.lib
/debug
/DEBUG
/RELEASE
user32.lib
kernel32.lib
dbghelp.lib
/EXPORT:DFunc
d2r.obj
   Creating library d2r.lib and object d2r.exp

injected the dll with withdll.exe from detours sample

e:\test\detours>e:\detour\bin.X86\withdll.exe /d:d2r.dll .\calc.exe
withdll.exe: Starting: `.\calc.exe'
withdll.exe:   with `e:\test\detours\d2r.dll'
C-style arbitrary precision calculator (version 2.11.10.1)
Calc is open software. For license details type:  help copyright
[Type "exit" to exit, or "help" for help.]

;

the detour dumps all the six arguments

; 2+2
Arg  0 = 0x0134b750     0x00000002
Arg  1 = 0x00000001
Arg  2 = 0x00000000
Arg  3 = 0x68de11f4     0x00000002
Arg  4 = 0x00000001
Arg  5 = 0x00000000
        4
; 45^89
        1367457148855142104017389933103900519105
058455901337287730364197964327832579556343262083
; 4^8
Arg  0 = 0x0134b7f8     0x00000004
Arg  1 = 0x00000001
Arg  2 = 0x00000000
Arg  3 = 0x68de11fc     0x00000004
Arg  4 = 0x00000001
Arg  5 = 0x00000000
        65536
; 4.5^8
Arg  0 = 0x0134b828     0x0000002d
Arg  1 = 0x00000001
Arg  2 = 0x00000000
Arg  3 = 0x0134dab8     0x0000000a
Arg  4 = 0x00000001
Arg  5 = 0x00000000
        168151.25390625
; 3&5
Arg  0 = 0x0134b828     0x00000003
Arg  1 = 0x00000001
Arg  2 = 0x00000000
Arg  3 = 0x68de11f8     0x00000003
Arg  4 = 0x00000001
Arg  5 = 0x00000000
        1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.