1

I am studying assembly and hooking.

I know how to hook x86 assembly now. so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function. I think this is normal hooking principle. https://www.apriorit.com/dev-blog/160-apihooks

And now, I want to hook x86 registers or memory in windows 32bit, like almost debugger's breakpoints do. So when some memory areas are accessed, automatically call my function in that process memory. To be exact, I want to use my hooked function instead of breakpoint. Any advance will be appreciated!

Improve this question
3
  • Welcome to RE.SE! Uhm, actually setting a breakpoint will in fact - through operating system facilities - typically end up as some kind of "hook function" being called. Alas you don't specify the environment (such as the OS) you're running in and it's not exactly clear what you're looking for, given how breakpoints pretty much already achieve what you want (in particular hardware-assisted breakpoints, whose number is limited, though).
    – 0xC0000022L ♦
    Aug 17, 2018 at 11:21
  • Thank your for approaching to my problem. 1. I am using windows x32. I think the OS is not a problem. 2. I know about hardware breakpoint. I want sth similar to hardware breakpoint, but I want a function called when condition is matched, instead of breakpoint. Thank you
    – Luis Bergmann
    Aug 17, 2018 at 13:09
  • @LuisBergmann: Please, edit your question to add these information in it (and add some tags about your OS and the CPU architecture targeted).
    – perror
    Aug 17, 2018 at 15:30

1 Answer 1

Reset to default
0

The only way this can be accomplished, in my opinion, is to override the Page Fault Handler. You cannot do this in user mode, however. The hooks you cite deal with user mode DLL entry points, which is easy to achieve. The paging mechanism is implemented in the kernel, at Ring 0, so basically you will need to write a driver which, in case of a Page Fault, checks if the address is in the range you want monitored and, if yes, calls your function; otherwise calls the default kernel routines. Quite tricky to do, especially on Windows (Linux is somewhat easier) and you risk in de-stabilizing the entire system.

This is what kernel-mode debuggers such as SoftICE (https://en.wikipedia.org/wiki/SoftICE) or WinDbg (https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windbg--kernel-mode-) do.

If you really want to go for it, a good starting point for information is here: https://stackoverflow.com/questions/18431261/how-does-x86-paging-work and of course https://docs.microsoft.com/en-us/windows-hardware/drivers/

PS: No way to do it for registers

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.