Questions tagged [function-hooking]

Correspond to all the techniques used to intercept function calls and to attach a piece of code before or/and after the execution of the function itself.

Filter by
Sorted by
Tagged with
0 votes
0 answers
30 views

SetPixel seem not work on some external window

I have succefully hooked a game and I need to do read and write with GetPixel and SetPixel to the game window. To do a test I have created this code: Here my hooked function: My_hooked_function(int a3)...
user avatar
2 votes
1 answer
237 views

How to hook to a system function

How to hook to external library function, such as OpenGL for example. I have a function used by the program I am trying to change behaviour of. The function is: lVar17 = glfwCreateWindow(uVar22,uVar25,...
user avatar
  • 146
3 votes
3 answers
291 views

IAT Hook via Kernel Driver

I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver. I want to hook the IAT of another driver from my driver if that makes sense. So I ...
user avatar
  • 49
0 votes
1 answer
99 views

How to declare a constructor in reversed class?

I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address. It is declared like this: game.h namespace ...
user avatar
  • 146
1 vote
1 answer
63 views

Using struct objects and constructors in hooked function

Will try to reword the actual question so it is hopefully more descriptive and clear of what I am after: So, there is a function main, which I have successfully hooked. The hooked version looks like ...
user avatar
  • 146
2 votes
1 answer
161 views

Hooking IAT in remote process with Python?

I'm trying to hook a win32 function call (CreateFileW) inside of a notepad process to have the function do additional actions before returning what it should do. Ultimately, this will assist me in ...
user avatar
1 vote
1 answer
120 views

Inconsistency in function addresses of the hooked functions (address shift)

I came across "a strange" inconsistency in terms of the function addresses in the particular application. First, the main function is hooked successfully, the address is derived in a fashion:...
user avatar
  • 146
1 vote
1 answer
272 views

DetourAttach breaks with Illegal Instruction 0xC000001D

I am trying to detour a function using DetourAttach() in the following fashion: hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
user avatar
  • 146
2 votes
2 answers
162 views

Adding a hook to the end of a function

I have a (so-called) function with multiple entry points but only one ret. I am trying to understand how to add a hook to the function. The main problem I'm facing is the code that is placed right ...
user avatar
  • 121
2 votes
0 answers
45 views

Cant hook into native lib with script?

im doing some practice stuff about hooking android native lib. I wrote this script: function processJniOnLoad(libraryName) { const funcSym = "...
user avatar
0 votes
2 answers
124 views

Using IAT Hooking to hook end of function

Is it possible? Maybe you can explain it with a simple example if that's possible?
user avatar
0 votes
0 answers
81 views

finding a not-so-straightforward game's function

I am working on Mad Max game [ APEX engine ] I do my best to explain the situation. so my target executes function like this: there are commands like " call [eax+XX] " or " call RX &...
user avatar
  • 11
3 votes
2 answers
712 views

Frida reading files is slow

I need to read a file around 2 MB into a byte array. var fis = Java.use("java.io.FileInputStream"); var file = fis.$new("/data/local/file.txt"); var fileBytes = new Uint8Array(file....
user avatar
  • 31
1 vote
0 answers
65 views

Why do some antiviruses hook x64 Ntdll in WOW64 process?

Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.
user avatar
  • 131
1 vote
1 answer
112 views

Hook naked function with CPU registers

I need to hook this function: .text:005589CB sub_5589CB proc near ; CODE XREF: AddHealth(int,long)+1A↑j .text:005589CB ; sub_5328D8+98E↑p ... ...
user avatar
1 vote
0 answers
327 views

Miasm VS Triton - which to choose? [closed]

Hello and thank you for reading my question, I was wondering, which is the right tool for me to choose according to the following: I will be using it mainly for Malware analysis and for exploit ...
user avatar
2 votes
1 answer
131 views

How use signature pattern for hooking

I like to replace the static function address: AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer) using signature pattern: SigScan ...
user avatar
-1 votes
1 answer
127 views

Function pointer reference

I need to hook 10/20 functions like these: static void* __cdecl HookFunction1(char *FileName, int a2, int a3, int a4); __declspec(naked) void HookFunction2(char *Src, int pedx, int a3, ...
user avatar
0 votes
1 answer
185 views

modern instrumentation for reversing and researching [closed]

i am really glad i found this great site and wanted to ask from your expertise regarding the following issue: i have been doing malware analysis and researching for a few years, and i want to learn ...
user avatar
1 vote
1 answer
370 views

how to hook __usercall function with microsoft detours

I need to hook a __usercall function in particular I need to read only the first parameter: char __usercall sub_4F3E6D@<al>(char *Src@<ecx>, int a2@<edx>, int a3, int a4, char a5, ...
user avatar
0 votes
0 answers
92 views

Easy way to attach a DLL to a Game

I like to attach a dll to a game to add more features. The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game. My idea is use this technique: dinput_ori.dll (...
user avatar
1 vote
0 answers
73 views

Alternative to MS Detours (32 bit)

I have used MS Detours for one project in c++ and work perfectly. I have created a clone of this application (95% of the some code) to hook another file (a GOG game with DRM free), but this time crash ...
user avatar
0 votes
0 answers
80 views

What's the way to find a function on a unity game and how I call it after I find?

I'm a newbye, so sorry for the basic questions, before anyone downvote the question. I'm Learning reverse engineering, I've already learned assembly for mips on the computer science underdegree and I ...
user avatar
  • 1
0 votes
0 answers
117 views

Crash after hook a function

I have hooked a sound function that work within the game menu after, when the battle start, the game will crash. The function at the first parameter get correctly the sound file name, before the ...
user avatar
1 vote
1 answer
297 views

frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?

I wanted to hook the method A1f in the below code but frida returns the following exceptions: Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)} java.lang....
user avatar
  • 179
0 votes
1 answer
414 views

best approach to hook function

I have found 2 source code example to hook a function. Example1: #include "detours.h" #include "sigscan.h" // this is the function that the program // will jump to when sum() is ...
user avatar
0 votes
0 answers
268 views

DLL injection (Failed to inject)

I have found this complete and easy example to test the function hook: https://github.com/Zer0Mem0ry/Detour #include <Windows.h> #include <iostream> #include "detours.h" #...
user avatar
3 votes
0 answers
187 views

How are single-player games made into multiplayer ones? [closed]

I was always curious about how some single-player games are turned into multiplayer ones. Some samples are SA-MP and MTA, that turn Grand Theft Auto: San Andreas into a multiplayer game. In an ...
user avatar
1 vote
0 answers
105 views

what are modern hooking techniques? [closed]

i was looking at interesting anti malware roles (malware analysis and prevention) and among the required skills they mentioned that "modern hooking techniques" should be well acquainted with. i was ...
user avatar
4 votes
1 answer
184 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
user avatar
1 vote
1 answer
182 views

Detours not cleaning the stack correctly

I'm trying to hook a function using Detours for the first time. I'm new to reversing software and to hooking, so I may have missed something big here. I'm trying to use this function as a hook: ...
user avatar
  • 187
2 votes
1 answer
284 views

Hiding a file in a Windows operating system

I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis. What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
user avatar
  • 21
0 votes
0 answers
139 views

Detouring function cause exception access violation

i am learning to detouring functions, but i run into one that i cannot be resolved. I use the Detour lib from microsoft, and a custom method. Both cause the same problem, the function is hooked and ...
user avatar
  • 101
1 vote
2 answers
210 views

learning detour and code injection

i am looking to expand my knowledge so i can someday(hopefully within few months) be able to join the reverse engineering community, probably in the anti-virus/defense field. i was wondering, since ...
user avatar
  • 19
1 vote
0 answers
187 views

How to hook eval function in node.js

As the eval() function of JavaScript is an evil, I want to hook or monkey-patch eval() function of JavaScript in node.js. I want to intercept all arguments passed in eval() function. Please guide me ...
user avatar
0 votes
1 answer
196 views

Function Hooking via Dll Injection Negative Offset

I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to ...
user avatar
4 votes
1 answer
1k views

Hooking function with frida

How can i hook functions with frida? Can someone give me an example please, for something that do that? Hook at 0x412312 and change the assembly code to "mov eax, 999" I Arleady tried something like:...
user avatar
  • 49
2 votes
2 answers
3k views

Patching JNZ (two byte opcode) into JMP near (one byte opcode)?

I've been tinkering with Fallout New Vegas, and have focused on modifying a very simple record that's hardcoded in the game engine. It's called an Imagespace Modifier, which is a very basic shader ...
user avatar
0 votes
0 answers
263 views

How Do i create a simple Detour Library

Quite new to Reverse Engineering and making Detour Functions, Just need some form of clarification here, i am trying to make a Simple x86 Detour library and i have worked on something using some ...
user avatar
  • 1
0 votes
0 answers
218 views

x64 hook Fails on Messagebox

Quite new to the intels so i might not know much , I just need some form of direction here. I am trying to do a simple 64 bit hook detour for function hooking I do it like so : The detour hook ...
user avatar
  • 1
0 votes
1 answer
194 views

Executing CMP DS:[] by inline assembly inline hooks

I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction. Followed by IDA, this instruction is: cmp off_41AE7048, ...
user avatar
  • 133
1 vote
1 answer
133 views

Why does vmt hooking not work with instance member in the following case?

Why does the function not get hooked when called with instance member obj.myFunc() ? class Myclass { public: virtual void myFunc() = 0; }; class Derived : public Myclass { public: void ...
user avatar
  • 13
0 votes
1 answer
73 views

Finding "controller vibration" function in game

I want to build a "force feedback chair" for Need for Speed: Payback, so I thought about hooking the function responsible for the controller vibration and sending the motor speed parameter to a motor ...
user avatar
  • 1
2 votes
0 answers
5k views

How to step to specific function call?

I'm reverse engineering an application and I identified a specific function call that has an output that I need to capture. For the actual capture, I'll do a memory dump, so that I can handle. However,...
user avatar
4 votes
4 answers
5k views

Calculation of jmp address through subtraction

I don't get why the two addresses of the functions are subtracted in order to get the jump destination. mov eax, [ebp+func1] sub eax, [ebp+func2] sub eax, 5 mov [ebp+var_4], eax Which ...
user avatar
  • 180
2 votes
1 answer
868 views

Trying to hook DirectX9 using C++ - Keeps crashing

I posted a thread on StackOverflow a few days ago, and it's got little attention, so i though it's possible this might be a better place for it. As the title says, i'm trying to hook/detour DirectX9 ...
user avatar
1 vote
1 answer
101 views

Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?

I am studying assembly and hooking. I know how to hook x86 assembly now. so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function. I think ...
user avatar
2 votes
0 answers
1k views

frida hook jni not work

I want to trace Android Telegram app(open-source) to learn its protocol. From the source code these two functions AES_set_encrypt_key and AES_ctr128_encrypt are used to do the encryption, and I can ...
user avatar
  • 197
1 vote
0 answers
728 views

How to hook into OpenSSL shared library?

To preface, I am not a well-versed developer in the whole business of reverse engineering or even most basic programming. This is a project I made with the goal of attempting to replicate an existing ...
user avatar
  • 11
-1 votes
1 answer
235 views

Hooking flash player dll

Lately I came to game-bot for browser flash-game which gets data from flashplayer dll. The main point of doing this was to get decrypted data(JSON) sent from game server to client through TCP. Do ...
user avatar