0

i am learning to detouring functions, but i run into one that i cannot be resolved.

I use the Detour lib from microsoft, and a custom method. Both cause the same problem, the function is hooked and returns to the original, but continuing the program crashes with error.

My code using Detours lib:

Function definition:

typedef int(__stdcall* itemPos) ( int param_1, float param_2, float param_3, float param_4, float param_5, float param_6, float param_7);
itemPos originalItemPos;
int __stdcall hkItemPos(int param_1, float param_2, float param_3, float param_4, float param_5, float param_6, float param_7) {
    return originalItemPos(param_1, param_2, param_3, param_4, param_5, param_6, param_7);
}

Initialice detours to hook:

DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DWORD offset = Scanner.FindPattern("program.exe", "\x55\x8B\xEC\x83\xE4", "xxxxx");
originalItemPos = (itemPos)offset;
DetourAttach(&(LPVOID&)originalItemPos, &hkItemPos);
if (DetourTransactionCommit() != NO_ERROR)
    printf("Detoured error in sub_CCD440\n");

The function looks like this in IDA

The way it is called

Error image

I have code to hook the function without using a library, but the error i get is the same, so i guess something is being overlooked. If necessary i will add it.

Thank you very much in advance.

  • how are you verifying that function is the correct function being being hooked? It could just be calling the original. Do you have prints in the hkItemPos() or anything to verify? Does the offset value make sense for the binary? That looks like a very very common search string I would guess you're hooking something else and when that gets called you crash – mumbel Mar 5 at 3:12
  • Hi mumbel, i have added a printf inside the method, in addition to using breakpoints using IDA and the method hooks correctly. I have cut the search string so that the code was not very extensive. But definitely yes, it hooks to the right function. – Israel Mar 5 at 3:29
  • Have you tried attaching the debugger or dumping the process to verify that the trampoline is correctly placed, that the stack is correctly preserved between calls and that the calling convention is correct? – Yennefer Mar 6 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.