I wrote this simple application in C++ to learn about reverse engineering:

#include <iostream>
#include <windows.h>

void PrintMessage(const char *message) {
    std::cout << message << "\n";

int main() {
    while (true) {
        if (GetAsyncKeyState(VK_SPACE) & 0x1) {
            PrintMessage("Space Pressed");
    return 0;

First of all, I don't know what is the right way to call them, and probably that's the reason why I cannot find any information about it, but by "non-native/non-exported functions" I mean any function that was written within the app and not imported from another DLL, like user32.dll for MessageBox native API.

Assuming I don't know anything about the app above, but I have it's compiled executable file, is it possible to find PrintMessage's address in it, and hook or call it from an external process? (through DLL injection, maybe?)

My goal is to write a second app, that can attach to the one above to achieve 2 things:

  • Log every time PrintMessage is called by the app, and it's arguments.
  • Force PrintMessage call to log an arbitrary message from the outside.

I've found plenty of tutorials about Native Functions, mainly Windows API, but none related to what I'm trying to achieve. Is it even possible? What should I look for to learn about it?

  • The PrintMessage function should be seen as function if you load the compiled binary in Ghidra or a similar tool. However the compiler my optimize your code and automatically inline the code of PrintMessage, in such a case you won't find a separate function. If you have a function you can hook it. For hooking a non-exported function using frida please see my related answer on Stackoverflow.
    – Robert
    Mar 28 at 9:19
  • @Robert Thank you. After compiling my app on debug mode, I was able to find the functions using x64dbg. However, release mode does what you're saying about optimizing and inlining functions. In those cases, is still possible to hook to inline functions? I believe that most real apps use release settings to deliver their software, so I wonder if this technique could be used on real scenarios with more knowledge to detect inline functions, or if inline functions cannot be called from the outside.
    – Unknown X
    Mar 28 at 19:39
  • @Robert Also, is there any conventions that compilers use for preparation of functions? I've found a tutorial where a DLL written in C was injected to an app written in C as well, so the pointer to the function address worked like a charm. I wonder if different compilers use different "prologue" for their functions (e.g. parameters setup), or there are a standard of calling conventions for every compiler.
    – Unknown X
    Mar 28 at 19:42


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.