Questions tagged [function-hooking]

Correspond to all the techniques used to intercept function calls and to attach a piece of code before or/and after the execution of the function itself.

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

How does it calculate a backup checksum

in Ghidra I found a function that calculates a checksum and checks it against a checksum in a protobuf I'm stuck in this function for days and I tried using frida to get the ret value but it doesn't ...
Arito No's user avatar
1 vote
0 answers
297 views

Read value from frida hooked native method Jlong parameter

I am new to using frida for hooking native android code i.e lib.so, so I have load the lib into ghidra and can find the native function. the native function is getting 5 params including jnienv and ...
hanan's user avatar
  • 309
1 vote
0 answers
32 views

Anyway to hook to change file content and return for application keep read it?

is there anyway to modify v2 before statement if(v2) happen?
user3082026's user avatar
3 votes
0 answers
125 views

How can I find out which system functions are used in applications using dynamic loading?

I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours ...
DertliSelo's user avatar
2 votes
0 answers
170 views

How can I detect which Android native function that is hooked by Mobile Substrate: MSHookFunction?

I want to detect hook behavior of MSHookFunction on Android. This is Mobile Substrate I use in my test app https://github.com/Breathleas/Android-Hooking-Template-Cydia-Substrate/tree/master/jni/...
Ken Kem's user avatar
  • 121
2 votes
0 answers
121 views

statically placing hooks on PE file's IAT

recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully ...
VEIL's user avatar
  • 21
1 vote
0 answers
153 views

problem with hooking __usercall function and asm code

I need a hook function with the __usercall convention. I already hooked functions that were defined as __usercall and __userpurge, but this time it's __usercall with arguments that are also passed ...
user42122's user avatar
2 votes
0 answers
48 views

Redirect exception handler?

I'm working on a localization project and have a few trampoline hooks to translate some text in an online game. Periodically throughout gameplay, there are checks that run in the background to ensure ...
isuckatreversing's user avatar
1 vote
0 answers
67 views

Is there any Android application that can manipulate the http response?

Is there any android app to manipulate http response body without vpn? for example: from "0|{random_string}|Wrong" Becomes "1|{random_string}|True" Thanks in advance
akunguti's user avatar
2 votes
0 answers
1k views

How can I enumerate and hook all non-exported functions in lib.so using frida?

I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported ...
hanan's user avatar
  • 309
1 vote
0 answers
96 views

Problem to hook a parameter with _thiscall function

I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function: .text:00488DA0 ; =============== S U B R O U T I N E ==========================...
user3449922's user avatar
1 vote
0 answers
104 views

SetPixel seem not work on some external window

I have succefully hooked a game and I need to do read and write with GetPixel and SetPixel to the game window. To do a test I have created this code: Here my hooked function: My_hooked_function(int a3)...
user3449922's user avatar
2 votes
1 answer
497 views

How to hook to a system function

How to hook to external library function, such as OpenGL for example. I have a function used by the program I am trying to change behaviour of. The function is: lVar17 = glfwCreateWindow(uVar22,uVar25,...
Irbis77's user avatar
  • 326
3 votes
3 answers
932 views

IAT Hook via Kernel Driver

I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver. I want to hook the IAT of another driver from my driver if that makes sense. So I ...
Ballers's user avatar
  • 49
0 votes
1 answer
286 views

How to declare a constructor in reversed class?

I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address. It is declared like this: game.h namespace ...
Irbis77's user avatar
  • 326
1 vote
1 answer
305 views

Using struct objects and constructors in hooked function

Will try to reword the actual question so it is hopefully more descriptive and clear of what I am after: So, there is a function main, which I have successfully hooked. The hooked version looks like ...
Irbis77's user avatar
  • 326
2 votes
1 answer
463 views

Hooking IAT in remote process with Python?

I'm trying to hook a win32 function call (CreateFileW) inside of a notepad process to have the function do additional actions before returning what it should do. Ultimately, this will assist me in ...
tunemein's user avatar
1 vote
1 answer
152 views

Inconsistency in function addresses of the hooked functions (address shift)

I came across "a strange" inconsistency in terms of the function addresses in the particular application. First, the main function is hooked successfully, the address is derived in a fashion:...
Irbis77's user avatar
  • 326
1 vote
1 answer
1k views

DetourAttach breaks with Illegal Instruction 0xC000001D

I am trying to detour a function using DetourAttach() in the following fashion: hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
Irbis77's user avatar
  • 326
2 votes
2 answers
316 views

Adding a hook to the end of a function

I have a (so-called) function with multiple entry points but only one ret. I am trying to understand how to add a hook to the function. The main problem I'm facing is the code that is placed right ...
EL_9's user avatar
  • 121
2 votes
0 answers
115 views

Cant hook into native lib with script?

im doing some practice stuff about hooking android native lib. I wrote this script: function processJniOnLoad(libraryName) { const funcSym = "...
Brian MJ's user avatar
1 vote
2 answers
253 views

Using IAT Hooking to hook end of function

Is it possible? Maybe you can explain it with a simple example if that's possible?
Michael's user avatar
  • 11
0 votes
0 answers
94 views

finding a not-so-straightforward game's function

I am working on Mad Max game [ APEX engine ] I do my best to explain the situation. so my target executes function like this: there are commands like " call [eax+XX] " or " call RX &...
shetal's user avatar
  • 51
3 votes
2 answers
2k views

Frida reading files is slow

I need to read a file around 2 MB into a byte array. var fis = Java.use("java.io.FileInputStream"); var file = fis.$new("/data/local/file.txt"); var fileBytes = new Uint8Array(file....
Cagri's user avatar
  • 176
1 vote
0 answers
87 views

Why do some antiviruses hook x64 Ntdll in WOW64 process?

Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.
DBenson's user avatar
  • 131
1 vote
1 answer
297 views

Hook naked function with CPU registers

I need to hook this function: .text:005589CB sub_5589CB proc near ; CODE XREF: AddHealth(int,long)+1A↑j .text:005589CB ; sub_5328D8+98E↑p ... ...
user3449922's user avatar
1 vote
0 answers
564 views

Miasm VS Triton - which to choose? [closed]

Hello and thank you for reading my question, I was wondering, which is the right tool for me to choose according to the following: I will be using it mainly for Malware analysis and for exploit ...
journey1's user avatar
2 votes
1 answer
439 views

How use signature pattern for hooking

I like to replace the static function address: AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer) using signature pattern: SigScan ...
user3449922's user avatar
1 vote
1 answer
217 views

Function pointer reference

I need to hook 10/20 functions like these: static void* __cdecl HookFunction1(char *FileName, int a2, int a3, int a4); __declspec(naked) void HookFunction2(char *Src, int pedx, int a3, ...
user3449922's user avatar
0 votes
1 answer
274 views

modern instrumentation for reversing and researching [closed]

i am really glad i found this great site and wanted to ask from your expertise regarding the following issue: i have been doing malware analysis and researching for a few years, and i want to learn ...
journey's user avatar
1 vote
1 answer
815 views

how to hook __usercall function with microsoft detours

I need to hook a __usercall function in particular I need to read only the first parameter: char __usercall sub_4F3E6D@<al>(char *Src@<ecx>, int a2@<edx>, int a3, int a4, char a5, ...
user3449922's user avatar
1 vote
0 answers
165 views

Easy way to attach a DLL to a Game

I like to attach a dll to a game to add more features. The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game. My idea is use this technique: dinput_ori.dll (...
user3449922's user avatar
1 vote
0 answers
139 views

Alternative to MS Detours (32 bit)

I have used MS Detours for one project in c++ and work perfectly. I have created a clone of this application (95% of the some code) to hook another file (a GOG game with DRM free), but this time crash ...
user3449922's user avatar
0 votes
0 answers
137 views

What's the way to find a function on a unity game and how I call it after I find?

I'm a newbye, so sorry for the basic questions, before anyone downvote the question. I'm Learning reverse engineering, I've already learned assembly for mips on the computer science underdegree and I ...
Luiz's user avatar
  • 1
0 votes
0 answers
213 views

Crash after hook a function

I have hooked a sound function that work within the game menu after, when the battle start, the game will crash. The function at the first parameter get correctly the sound file name, before the ...
user3449922's user avatar
1 vote
1 answer
509 views

frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?

I wanted to hook the method A1f in the below code but frida returns the following exceptions: Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)} java.lang....
hanan's user avatar
  • 309
0 votes
1 answer
744 views

best approach to hook function

I have found 2 source code example to hook a function. Example1: #include "detours.h" #include "sigscan.h" // this is the function that the program // will jump to when sum() is ...
user3449922's user avatar
0 votes
0 answers
490 views

DLL injection (Failed to inject)

I have found this complete and easy example to test the function hook: https://github.com/Zer0Mem0ry/Detour #include <Windows.h> #include <iostream> #include "detours.h" #...
user3449922's user avatar
3 votes
0 answers
247 views

How are single-player games made into multiplayer ones? [closed]

I was always curious about how some single-player games are turned into multiplayer ones. Some samples are SA-MP and MTA, that turn Grand Theft Auto: San Andreas into a multiplayer game. In an ...
Stanley Sathler's user avatar
1 vote
0 answers
137 views

what are modern hooking techniques? [closed]

i was looking at interesting anti malware roles (malware analysis and prevention) and among the required skills they mentioned that "modern hooking techniques" should be well acquainted with. i was ...
beginner's user avatar
4 votes
1 answer
308 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
Coldblackice's user avatar
1 vote
1 answer
359 views

Detours not cleaning the stack correctly

I'm trying to hook a function using Detours for the first time. I'm new to reversing software and to hooking, so I may have missed something big here. I'm trying to use this function as a hook: ...
Stud's user avatar
  • 187
2 votes
1 answer
421 views

Hiding a file in a Windows operating system

I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis. What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
turtle's user avatar
  • 21
0 votes
0 answers
259 views

Detouring function cause exception access violation

i am learning to detouring functions, but i run into one that i cannot be resolved. I use the Detour lib from microsoft, and a custom method. Both cause the same problem, the function is hooked and ...
Israel's user avatar
  • 101
1 vote
2 answers
413 views

learning detour and code injection

i am looking to expand my knowledge so i can someday(hopefully within few months) be able to join the reverse engineering community, probably in the anti-virus/defense field. i was wondering, since ...
newB's user avatar
  • 19
1 vote
0 answers
271 views

How to hook eval function in node.js

As the eval() function of JavaScript is an evil, I want to hook or monkey-patch eval() function of JavaScript in node.js. I want to intercept all arguments passed in eval() function. Please guide me ...
sumit_suthar's user avatar
0 votes
1 answer
262 views

Function Hooking via Dll Injection Negative Offset

I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to ...
user192148's user avatar
4 votes
1 answer
2k views

Hooking function with frida

How can i hook functions with frida? Can someone give me an example please, for something that do that? Hook at 0x412312 and change the assembly code to "mov eax, 999" I Arleady tried something like:...
yoni's user avatar
  • 59
2 votes
2 answers
5k views

Patching JNZ (two byte opcode) into JMP near (one byte opcode)?

I've been tinkering with Fallout New Vegas, and have focused on modifying a very simple record that's hardcoded in the game engine. It's called an Imagespace Modifier, which is a very basic shader ...
FiftyTifty's user avatar
0 votes
0 answers
359 views

How Do i create a simple Detour Library

Quite new to Reverse Engineering and making Detour Functions, Just need some form of clarification here, i am trying to make a Simple x86 Detour library and i have worked on something using some ...
Josh's user avatar
  • 1