0

Quite new to the intels so i might not know much , I just need some form of direction here. I am trying to do a simple 64 bit hook detour for function hooking

I do it like so :

The detour hook Engine :

BOOL JHook::SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length)
{
    LPVOID FunctionAddress;
    DWORD TrampolineLength = 0, OriginalProtection;
    hde64s disam;
    BYTE Jump[13] = { 0x49, 0xBB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x41, 0xFF, 0xE3 };

    FunctionAddress = GetProcAddress(GetModuleHandleA(dll), name);
    if (!FunctionAddress)
        return FALSE;

    //disassemble length of each instruction, until we have 5 or more bytes worth
    while (TrampolineLength < 5)
    {
        LPVOID InstPointer = (LPVOID)((DWORD)FunctionAddress + TrampolineLength);
        TrampolineLength += hde64_disasm(InstPointer, &disam);
    }

    //Build the trampoline buffer
    memcpy(original, FunctionAddress, TrampolineLength);
    *(DWORD*)(Jump + 1) = ((DWORD)FunctionAddress + TrampolineLength) - ((DWORD)original + TrampolineLength + 5);
    memcpy((LPVOID)((DWORD)original + TrampolineLength), Jump, 5);

    //Make sure the function is writable
    if (!VirtualProtect(FunctionAddress, TrampolineLength, PAGE_EXECUTE_READWRITE, &OriginalProtection))
        return FALSE;

    //Build and atomically write the hook
    *(DWORD*)(Jump + 1) = (DWORD)proxy - (DWORD)FunctionAddress - 5;
    //SafeMemcpyPadded(FunctionAddress, Jump, 5);

    //Restore the original page protection
    VirtualProtect(FunctionAddress, TrampolineLength, OriginalProtection, &OriginalProtection);

    //Clear CPU instruction cache
    FlushInstructionCache(GetCurrentProcess(), FunctionAddress, TrampolineLength);

    *length = TrampolineLength;
    return TRUE;
}

The header file.

#pragma once

    #include <stdio.h>
    #include <stdlib.h>
    #include <Windows.h>
    #include "hde64.h"

    class SHook
    {
    private :
        LPVOID FunctionAddress;
        DWORD TrampolineLength = 0, OriginalProtection;
        hde64s disam;
        BYTE Jump[13] = { 0x49, 0xBB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x41, 0xFF, 0xE3 };
    public:
        BOOL SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length);
    };

Now the implementation

#include <stdio.h>
#include <Windows.h>
#include <intrin.h>
#include <string>
#include "JHook.h"

typedef int (WINAPI* TdefOldMessageBoxA)(HWND hWnd, LPCSTR lpText, LPCTSTR lpCaption, UINT uType);
TdefOldMessageBoxA myOldMessageBoxA;

JHook Jhook;
int WINAPI HookMessageBoxA(HWND hWnd, LPCSTR lpText, LPCTSTR lpCaption, UINT uType) 
{
    MessageBoxA(NULL, "Hooked", "Hooked", MB_OK);
    return myOldMessageBoxA(hWnd, lpText, lpCaption, uType);
}

void EstablishHook()
{
        Jhook.SetHook("user32.dll","MessageBoxA", (LPVOID)&HookMessageBoxA, myOldMessageBoxA,0);
}

int main() 
{
    EstablishHook();
}

Now i was expecting to see something like a Messagebox saying its hooked, and i just see a cmd nothing else, where am i getting it wrong?

Edit

Opening inside a Debugger i have this

00007FF663D143F4 | 55                       | push rbp                                |
00007FF663D143F5 | 57                       | push rdi                                |
00007FF663D143F6 | 48:81EC E8000000         | sub rsp,E8                              |
00007FF663D143FD | 48:8D6C24 20             | lea rbp,qword ptr ss:[rsp+20]           |
00007FF663D14402 | 48:8BFC                  | mov rdi,rsp                             |
00007FF663D14405 | B9 3A000000              | mov ecx,3A                              | 3A:':'
00007FF663D1440A | B8 CCCCCCCC              | mov eax,CCCCCCCC                        |
00007FF663D1440F | F3:AB                    | rep stosd                               |
00007FF663D14411 | 48:8B8C24 08010000       | mov rcx,qword ptr ss:[rsp+108]          |
00007FF663D14419 | 48:8D0D 15FC0000         | lea rcx,qword ptr ds:[7FF663D24035]     | MessageBoxTest.cpp:15732480
00007FF663D14420 | E8 5DCCFFFF              | call shook.7FF663D11082                 |
00007FF663D14425 | 45:33C9                  | xor r9d,r9d                             | MessageBoxTest.cpp:13
00007FF663D14428 | 4C:8D05 95880000         | lea r8,qword ptr ds:[7FF663D1CCC4]      | 00007FF663D1CCC4:"Hooked"
00007FF663D1442F | 48:8D15 8E880000         | lea rdx,qword ptr ds:[7FF663D1CCC4]     | 00007FF663D1CCC4:"Hooked"
00007FF663D14436 | 33C9                     | xor ecx,ecx                             |
00007FF663D14438 | FF15 2AED0000            | call qword ptr ds:[<&MessageBoxA>]      |
00007FF663D1443E | 44:8B8D F8000000         | mov r9d,dword ptr ss:[rbp+F8]           | MessageBoxTest.cpp:14
00007FF663D14445 | 4C:8B85 F0000000         | mov r8,qword ptr ss:[rbp+F0]            |
00007FF663D1444C | 48:8B95 E8000000         | mov rdx,qword ptr ss:[rbp+E8]           |
00007FF663D14453 | 48:8B8D E0000000         | mov rcx,qword ptr ss:[rbp+E0]           |
00007FF663D1445A | FF15 90AF0000            | call qword ptr ds:[<int (__cdecl* __ptr |
00007FF663D14460 | 48:8DA5 C8000000         | lea rsp,qword ptr ss:[rbp+C8]           | MessageBoxTest.cpp:15
00007FF663D14467 | 5F                       | pop rdi                                 |
00007FF663D14468 | 5D                       | pop rbp                                 |
00007FF663D14469 | C3                       | ret                                     |

Which shows the MessageBox Now i am a bit lost as to what to do next. Worked on detour Function, pls see above.

Edit

NOW i fixed the Sethook Engine now and it looks like this somehow

#include "SHook.h"

BOOL SHook::SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length)
{
    LPVOID FunctionAddress;
    DWORD TrampolineLength = 0, OriginalProtection;
    hde64s disam;
    BYTE Jump[14] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };

    FunctionAddress = GetProcAddress(GetModuleHandleA(dll), name);
    if (!FunctionAddress)
        return FALSE;

    //disassemble length of each instruction, until we have 5 or more bytes worth
    while (TrampolineLength < 5)
    {
        LPVOID InstPointer = (LPVOID)((DWORD64)FunctionAddress + TrampolineLength);
        TrampolineLength += hde64_disasm(InstPointer, &disam);
    }

    //Build the trampoline buffer
    memcpy(original, FunctionAddress, TrampolineLength);
    *(DWORD64*)(Jump + 1) = ((DWORD64)FunctionAddress + TrampolineLength) - ((DWORD64)original + TrampolineLength + 5); // <-- error falls here
    memcpy((LPVOID)((DWORD64)original + TrampolineLength), Jump, 5);

    //Make sure the function is writable
    if (!VirtualProtect(FunctionAddress, TrampolineLength, PAGE_EXECUTE_READWRITE, &OriginalProtection))
        return FALSE;

    //Build and atomically write the hook
    *(DWORD64*)(Jump + 1) = (DWORD64)proxy - (DWORD64)FunctionAddress - 5;
    //SafeMemcpyPadded(FunctionAddress, Jump, 5);

    //Restore the original page protection
    VirtualProtect(FunctionAddress, TrampolineLength, OriginalProtection, &OriginalProtection);

    //Clear CPU instruction cache
    FlushInstructionCache(GetCurrentProcess(), FunctionAddress, TrampolineLength);

    *length = TrampolineLength;
    return TRUE;
}

Other things remain the same. do not have an idea why it fails still , especially on this line :

*(DWORD64*)(Jump + 1) = ((DWORD64)FunctionAddress + TrampolineLength) - ((DWORD64)original + TrampolineLength + 5);
8
  • You don't seem to be calling MessageBoxA in order to trigger the hook.
    – 0xec
    Commented Jun 14, 2019 at 9:22
  • How u mean sir? @0xec
    – Daniel
    Commented Jun 14, 2019 at 9:26
  • I meant in the code you posted there's no call to MessageBoxA after setting the hook in order to check if it works or not.
    – 0xec
    Commented Jun 14, 2019 at 9:43
  • @0xec now i get this as error : Exception thrown: read access violation. p was 0x82042490.
    – Daniel
    Commented Jun 14, 2019 at 10:13
  • Now you need to use a debugger (x64dbg) and trace through the code particularly where you are calling MessageBoxA
    – 0xec
    Commented Jun 14, 2019 at 10:22

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.