Questions tagged [function-hooking]
Correspond to all the techniques used to intercept function calls and to attach a piece of code before or/and after the execution of the function itself.
105
questions
1
vote
0
answers
22
views
Anyway to hook to change file content and return for application keep read it?
is there anyway to modify v2 before statement if(v2) happen?
- 11
3
votes
0
answers
88
views
How can I find out which system functions are used in applications using dynamic loading?
I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours ...
- 31
2
votes
0
answers
92
views
How can I detect which Android native function that is hooked by Mobile Substrate: MSHookFunction?
I want to detect hook behavior of MSHookFunction on Android. This is Mobile Substrate I use in my test app https://github.com/Breathleas/Android-Hooking-Template-Cydia-Substrate/tree/master/jni/...
- 121
2
votes
0
answers
75
views
statically placing hooks on PE file's IAT
recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully ...
- 21
1
vote
0
answers
116
views
problem with hooking __usercall function and asm code
I need a hook function with the __usercall convention.
I already hooked functions that were defined as __usercall and __userpurge, but this time it's __usercall with arguments that are also passed ...
- 11
2
votes
0
answers
36
views
Redirect exception handler?
I'm working on a localization project and have a few trampoline hooks to translate some text in an online game. Periodically throughout gameplay, there are checks that run in the background to ensure ...
1
vote
0
answers
36
views
Is there any Android application that can manipulate the http response?
Is there any android app to manipulate http response body without vpn?
for example:
from
"0|{random_string}|Wrong"
Becomes
"1|{random_string}|True"
Thanks in advance
- 11
2
votes
0
answers
608
views
How can I enumerate and hook all non-exported functions in lib.so using frida?
I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported ...
- 289
1
vote
0
answers
59
views
Problem to hook a parameter with _thiscall function
I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function:
.text:00488DA0 ; =============== S U B R O U T I N E ==========================...
- 279
1
vote
0
answers
69
views
SetPixel seem not work on some external window
I have succefully hooked a game and I need to do read and write with GetPixel and SetPixel to the game window.
To do a test I have created this code:
Here my hooked function:
My_hooked_function(int a3)...
- 279
2
votes
1
answer
454
views
How to hook to a system function
How to hook to external library function, such as OpenGL for example.
I have a function used by the program I am trying to change behaviour of. The function is:
lVar17 = glfwCreateWindow(uVar22,uVar25,...
- 326
3
votes
3
answers
648
views
IAT Hook via Kernel Driver
I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver.
I want to hook the IAT of another driver from my driver if that makes sense.
So I ...
- 49
0
votes
1
answer
211
views
How to declare a constructor in reversed class?
I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address.
It is declared like this:
game.h
namespace ...
- 326
1
vote
1
answer
199
views
Using struct objects and constructors in hooked function
Will try to reword the actual question so it is hopefully more descriptive and clear of what I am after:
So, there is a function main, which I have successfully hooked. The hooked version looks like ...
- 326
2
votes
1
answer
354
views
Hooking IAT in remote process with Python?
I'm trying to hook a win32 function call (CreateFileW) inside of a notepad process to have the function do additional actions before returning what it should do. Ultimately, this will assist me in ...
- 51
1
vote
1
answer
128
views
Inconsistency in function addresses of the hooked functions (address shift)
I came across "a strange" inconsistency in terms of the function addresses in the particular application.
First, the main function is hooked successfully, the address is derived in a fashion:...
- 326
1
vote
1
answer
725
views
DetourAttach breaks with Illegal Instruction 0xC000001D
I am trying to detour a function using DetourAttach() in the following fashion:
hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
- 326
2
votes
2
answers
245
views
Adding a hook to the end of a function
I have a (so-called) function with multiple entry points but only one ret.
I am trying to understand how to add a hook to the function.
The main problem I'm facing is the code that is placed right ...
- 121
2
votes
0
answers
86
views
Cant hook into native lib with script?
im doing some practice stuff about hooking android native lib. I wrote this script:
function processJniOnLoad(libraryName) {
const funcSym = "...
- 57
1
vote
2
answers
225
views
Using IAT Hooking to hook end of function
Is it possible? Maybe you can explain it with a simple example if that's possible?
- 11
0
votes
0
answers
88
views
finding a not-so-straightforward game's function
I am working on Mad Max game [ APEX engine ]
I do my best to explain the situation.
so my target executes function like this:
there are commands like " call [eax+XX] " or " call RX &...
- 41
3
votes
2
answers
1k
views
Frida reading files is slow
I need to read a file around 2 MB into a byte array.
var fis = Java.use("java.io.FileInputStream");
var file = fis.$new("/data/local/file.txt");
var fileBytes = new Uint8Array(file....
- 166
1
vote
0
answers
82
views
Why do some antiviruses hook x64 Ntdll in WOW64 process?
Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.
- 131
1
vote
1
answer
219
views
Hook naked function with CPU registers
I need to hook this function:
.text:005589CB sub_5589CB proc near ; CODE XREF: AddHealth(int,long)+1A↑j
.text:005589CB ; sub_5328D8+98E↑p ...
...
- 279
1
vote
0
answers
465
views
Miasm VS Triton - which to choose? [closed]
Hello and thank you for reading my question,
I was wondering, which is the right tool for me to choose according to the following:
I will be using it mainly for Malware analysis and for exploit ...
- 11
2
votes
1
answer
292
views
How use signature pattern for hooking
I like to replace the static function address:
AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer)
using signature pattern:
SigScan ...
- 279
1
vote
1
answer
181
views
Function pointer reference
I need to hook 10/20 functions like these:
static void* __cdecl HookFunction1(char *FileName, int a2, int a3, int a4);
__declspec(naked) void HookFunction2(char *Src, int pedx, int
a3, ...
- 279
0
votes
1
answer
225
views
modern instrumentation for reversing and researching [closed]
i am really glad i found this great site and wanted to ask from your expertise regarding the following issue:
i have been doing malware analysis and researching for a few years, and i want to learn ...
- 1
1
vote
1
answer
658
views
how to hook __usercall function with microsoft detours
I need to hook a __usercall function in particular I need to read only the first parameter:
char __usercall sub_4F3E6D@<al>(char *Src@<ecx>, int a2@<edx>, int a3, int a4, char a5, ...
- 279
1
vote
0
answers
131
views
Easy way to attach a DLL to a Game
I like to attach a dll to a game to add more features.
The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game.
My idea is use this technique:
dinput_ori.dll (...
- 279
1
vote
0
answers
121
views
Alternative to MS Detours (32 bit)
I have used MS Detours for one project in c++ and work perfectly.
I have created a clone of this application (95% of the some code) to hook another file (a GOG game with DRM free), but this time crash ...
- 279
0
votes
0
answers
104
views
What's the way to find a function on a unity game and how I call it after I find?
I'm a newbye, so sorry for the basic questions, before anyone downvote the question.
I'm Learning reverse engineering, I've already learned assembly for mips on the computer science underdegree and I ...
- 1
0
votes
0
answers
179
views
Crash after hook a function
I have hooked a sound function that work within the game menu after, when the battle start, the game will crash.
The function at the first parameter get correctly the sound file name, before the ...
- 279
1
vote
1
answer
423
views
frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?
I wanted to hook the method A1f in the below code but frida returns the following exceptions:
Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)}
java.lang....
- 289
0
votes
1
answer
574
views
best approach to hook function
I have found 2 source code example to hook a function.
Example1:
#include "detours.h"
#include "sigscan.h"
// this is the function that the program
// will jump to when sum() is ...
- 279
0
votes
0
answers
418
views
DLL injection (Failed to inject)
I have found this complete and easy example to test the function hook:
https://github.com/Zer0Mem0ry/Detour
#include <Windows.h>
#include <iostream>
#include "detours.h"
#...
- 279
3
votes
0
answers
227
views
How are single-player games made into multiplayer ones? [closed]
I was always curious about how some single-player games are turned into multiplayer ones. Some samples are SA-MP and MTA, that turn Grand Theft Auto: San Andreas into a multiplayer game.
In an ...
- 131
1
vote
0
answers
131
views
what are modern hooking techniques? [closed]
i was looking at interesting anti malware roles (malware analysis and prevention) and among the required skills they mentioned that "modern hooking techniques" should be well acquainted with. i was ...
- 86
4
votes
1
answer
252
views
Where do mouse/keyboard GUI inputs get queued or stored?
Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing?
I'm wondering if it'd be possible ...
- 169
1
vote
1
answer
282
views
Detours not cleaning the stack correctly
I'm trying to hook a function using Detours for the first time. I'm new to reversing software and to hooking, so I may have missed something big here.
I'm trying to use this function as a hook:
...
- 187
2
votes
1
answer
380
views
Hiding a file in a Windows operating system
I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis.
What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
- 21
0
votes
0
answers
212
views
Detouring function cause exception access violation
i am learning to detouring functions, but i run into one that i cannot be resolved.
I use the Detour lib from microsoft, and a custom method.
Both cause the same problem, the function is hooked and ...
- 101
1
vote
2
answers
319
views
learning detour and code injection
i am looking to expand my knowledge so i can someday(hopefully within few months) be able to join the reverse engineering community, probably in the anti-virus/defense field.
i was wondering, since ...
- 19
1
vote
0
answers
243
views
How to hook eval function in node.js
As the eval() function of JavaScript is an evil, I want to hook or monkey-patch eval() function of JavaScript in node.js. I want to intercept all arguments passed in eval() function. Please guide me ...
- 111
0
votes
1
answer
226
views
Function Hooking via Dll Injection Negative Offset
I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to ...
- 13
4
votes
1
answer
2k
views
Hooking function with frida
How can i hook functions with frida?
Can someone give me an example please, for something that do that?
Hook at 0x412312 and change the assembly code to "mov eax, 999"
I Arleady tried something like:...
- 59
2
votes
2
answers
4k
views
Patching JNZ (two byte opcode) into JMP near (one byte opcode)?
I've been tinkering with Fallout New Vegas, and have focused on modifying a very simple record that's hardcoded in the game engine. It's called an Imagespace Modifier, which is a very basic shader ...
- 65
0
votes
0
answers
322
views
How Do i create a simple Detour Library
Quite new to Reverse Engineering and making Detour Functions, Just need some form of clarification here, i am trying to make a Simple x86 Detour library and i have worked on something using some ...
- 1
0
votes
0
answers
284
views
x64 hook Fails on Messagebox
Quite new to the intels so i might not know much , I just need some form of direction here.
I am trying to do a simple 64 bit hook detour for function hooking
I do it like so :
The detour hook ...
- 1
0
votes
1
answer
245
views
Executing CMP DS:[] by inline assembly inline hooks
I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction.
Followed by IDA, this instruction is:
cmp off_41AE7048, ...
- 133