1

I am trying to detour a function using DetourAttach() in the following fashion:

hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",
    *hook.first, hook.second));
writeProtectedMemory(hook.first, hook.second);
auto result = DetourAttach(hook.first, hook.second);

Where hook.first = 0x00007ff69f119ea0 {Gladius.exe!gladius::Game::main(int,char * *,char * *)} {0x8b4820ec83485340} void * *

hook.second = 0x00007ff818f51ef5 {swresample-3.dll!hooks::gamemainHooked(struct gladius::Game *,int,char * *,char * *)} void *

But the result comes with the following error:

Exception thrown at 0x00007FF69F119EA1 in Gladius.exe: 0xC000001D: Illegal Instruction.

And the question marks (see the screenshot) where the jump instruction supposed to be.

Memory around detoured function

Would appreciate some help in resolving this...

1 Answer 1

1

Fixed with using EasyHook instead of Detours. I.e. replaced this piece of code:

writeProtectedMemory(hook.first, hook.second);
auto result = DetourAttach(hook.first, hook.second);

with this:

HOOK_TRACE_INFO hHook = { NULL }; // keep track of our hook
NTSTATUS result = LhInstallHook(
    hook.first,
    hook.second,
    NULL,
    &hHook);

ULONG ACLEntries[1] = { 0 };
LhSetInclusiveACL(ACLEntries, 1, &hHook);

Where hook.first = 0x00007ff69f119ea0 {Gladius.exe!gladius::Game::main(int,char * *,char * *)} {0x8b4820ec83485340} void * *

And hook.second = 0x00007ff818f51ef5 {swresample-3.dll!hooks::gamemainHooked(struct gladius::Game *,int,char * *,char * *)} void *

Now the app correctly jumps to the Hooked function.

P.S. Don't know what is the deal with DetoursAttach() for x64. I have compiled it specifically for that environment.

May be it doesn't know of how to pass the hook between the threads... Will check that option later.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.