0

Quite new to Reverse Engineering and making Detour Functions, Just need some form of clarification here, i am trying to make a Simple x86 Detour library and i have worked on something using some Sources i saw on the Internet. Now i have a challenge with the simple MessageBox does not trigger errors at the same time , it fails to hook as i get this Execption

Exception thrown at 0x0F2B3839 (vcruntime140d.dll) in SHook.exe: 0xC0000005: Access violation writing location 0x75C51F70.

On this Line

memcpy(original, FunctionAddress, TrampolineLength);

My source code looks like this :

SHook.h

#pragma once

#include <stdio.h>
#include <stdlib.h>
#include <Windows.h>
#include "hde32.h"

class SHook
{
private :
    LPVOID FunctionAddress;
    DWORD TrampolineLength = 0, OriginalProtection;
    hde32s disam;
    BYTE Jump[5] = { 0xE9, 0x00, 0x00, 0x00, 0x00 };
public:
    BOOL SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length);
};

Now SHook.cpp

#include "SHook.h"

BOOL SHook::SetHook(LPCSTR dll, LPCSTR name, LPVOID proxy, LPVOID original, PDWORD length)
{
    LPVOID FunctionAddress;
    DWORD TrampolineLength = 0, OriginalProtection;
    hde32s disam;
    BYTE Jump[5] = { 0xE9, 0x00, 0x00, 0x00, 0x00 };

    FunctionAddress = GetProcAddress(GetModuleHandleA(dll), name);
    if (!FunctionAddress)
        return FALSE;

    //disassemble length of each instruction, until we have 5 or more bytes worth
    while (TrampolineLength < 5)
    {
        LPVOID InstPointer = (LPVOID)((DWORD)FunctionAddress + TrampolineLength);
        TrampolineLength += hde32_disasm(InstPointer, &disam);
    }

    //Build the trampoline buffer
    memcpy(original, FunctionAddress, TrampolineLength); //shoots error here
    *(DWORD*)(Jump + 1) = ((DWORD)FunctionAddress + TrampolineLength) - ((DWORD)original + TrampolineLength + 5);
    memcpy((LPVOID)((DWORD)original + TrampolineLength), Jump, 8);

    //Make sure the function is writable
    if (!VirtualProtect(FunctionAddress, TrampolineLength, PAGE_EXECUTE_READWRITE, &OriginalProtection))
        return FALSE;

    //Build and atomically write the hook
    *(DWORD*)(Jump + 1) = (DWORD)proxy - (DWORD)FunctionAddress - 5;
    //SafeMemcpyPadded(FunctionAddress, Jump, 5);

    //Restore the original page protection
    VirtualProtect(FunctionAddress, TrampolineLength, OriginalProtection, &OriginalProtection);

    //Clear CPU instruction cache
    FlushInstructionCache(GetCurrentProcess(), FunctionAddress, TrampolineLength);

    *length = TrampolineLength;
    return TRUE;
}

And the implementation is looking like this

MessageBoxTest.cpp

#include <stdio.h>
#include <Windows.h>
#include <intrin.h>
#include <string>
#include "SHook.h"

typedef int (WINAPI* TdefOldMessageBoxA)(HWND hWnd, LPCSTR lpText, LPCTSTR lpCaption, UINT uType);
TdefOldMessageBoxA myOldMessageBoxA;

SHook shook;
int WINAPI HookMessageBoxA(HWND hWnd, LPCSTR lpText, LPCTSTR lpCaption, UINT uType) 
{
    MessageBoxA(NULL, "Hooked", "Hooked", MB_OK);
    return myOldMessageBoxA(hWnd, lpText, lpCaption, uType);
}

void EstablishHook()
{
        myOldMessageBoxA = (TdefOldMessageBoxA)& MessageBoxA;
        shook.SetHook("user32.dll","MessageBoxA", (LPVOID)&HookMessageBoxA, myOldMessageBoxA,0);
}

int main() 
{
    EstablishHook();
}

Please Can someone give a clarification what i did miss pls

I am trying to understand what i missed there? Please i do need some form of help here

3
  • original seems to point to MessageBoxA so you write to non-writable memory. VirtualProtect will fix that (as you use afterwards) but this is a logical flaw in your code. Commented Jul 1, 2019 at 21:45
  • @JohannAydinbas Pls very new to things like this , just need a help of some sort with the line i should correct, say a snippet would be fine
    – Josh
    Commented Jul 2, 2019 at 7:26
  • 2
    Why do you want to create your own library? Take a look at Microsoft's Detour library, it probably does everything you want.
    – eric.m
    Commented Jul 3, 2019 at 9:44

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.