0

Is it possible? Maybe you can explain it with a simple example if that's possible?

0

The IAT entries point to the function's entry point, so you can try the following:

  1. Save the current IAT entry value into a variable (e.g. old_func).
  2. Patch the IAT entry with the address of your hook function.
  3. In the hook function, call the old function using old_func variable, then perform whatever you need before returning to the caller.
0

Hooking would be the same in both cases:

  • Whether you wanted to manipulate a function's parameters, and then provide them to the original function. In that case the order goes:
    1. Execute your hook code.
    2. Call the original function.
  • Or call the original function, then manipulate the return results. Order goes:
    1. Call the original function.
    2. Execute your hook code.



In both cases the steps will be:

  • Store the original function's entry from the IAT.
  • Replace the IAT entry with your hook's start address.
  • Do whatever you want inside your hook function.

EDIT: Typos and Language.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.