Questions tagged [function-hooking]

Correspond to all the techniques used to intercept function calls and to attach a piece of code before or/and after the execution of the function itself.

Filter by
Sorted by
Tagged with
0
votes
0answers
56 views

Easy way to attach a DLL to a Game

I like to attach a dll to a game to add more features. The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game. My idea is use this technique: dinput_ori.dll (...
0
votes
0answers
41 views

Question about basic hooking concept

I have created a c++ complete project to hook GOG game and work perfectly (this add a unofficial Force Feedback support). To to it I have found on github a custom version of d3d9.dll with with DllMain ...
1
vote
0answers
39 views

Alternative to MS Detours (32 bit)

I have used MS Detours for one project in c++ and work perfectly. I have created a clone of this application (95% of the some code) to hook another file (a GOG game with DRM free), but this time crash ...
0
votes
0answers
27 views

understand how call __usercall function

I have disassable with ida this function: int __usercall sub_4F314A@<eax>(char *Src@<ecx>, int a2@<edx>, int a3, int a4, int a5, int a6) I attach the original assembly: can you ...
0
votes
0answers
15 views

What's the way to find a function on a unity game and how I call it after I find?

I'm a newbye, so sorry for the basic questions, before anyone downvote the question. I'm Learning reverse engineering, I've already learned assembly for mips on the computer science underdegree and I ...
0
votes
0answers
36 views

Crash after hook a function

I have hooked a sound function that work within the game menu after, when the battle start, the game will crash. The function at the first parameter get correctly the sound file name, before the ...
0
votes
0answers
56 views

frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?

I wanted to hook the method A1f in the below code but frida returns the following exceptions: Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)} java.lang....
0
votes
1answer
97 views

best approach to hook function

I have found 2 source code example to hook a function. Example1: #include "detours.h" #include "sigscan.h" // this is the function that the program // will jump to when sum() is ...
0
votes
0answers
59 views

DLL injection (Failed to inject)

I have found this complete and easy example to test the function hook: https://github.com/Zer0Mem0ry/Detour #include <Windows.h> #include <iostream> #include "detours.h" #...
3
votes
0answers
97 views

How are single-player games made into multiplayer ones? [closed]

I was always curious about how some single-player games are turned into multiplayer ones. Some samples are SA-MP and MTA, that turn Grand Theft Auto: San Andreas into a multiplayer game. In an ...
1
vote
0answers
51 views

what are modern hooking techniques? [closed]

i was looking at interesting anti malware roles (malware analysis and prevention) and among the required skills they mentioned that "modern hooking techniques" should be well acquainted with. i was ...
2
votes
1answer
52 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
0
votes
1answer
66 views

Detours not cleaning the stack correctly

I'm trying to hook a function using Detours for the first time. I'm new to reversing software and to hooking, so I may have missed something big here. I'm trying to use this function as a hook: ...
1
vote
1answer
106 views

Hiding a file in a Windows operating system

I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis. What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
0
votes
0answers
62 views

Detouring function cause exception access violation

i am learning to detouring functions, but i run into one that i cannot be resolved. I use the Detour lib from microsoft, and a custom method. Both cause the same problem, the function is hooked and ...
1
vote
2answers
105 views

learning detour and code injection

i am looking to expand my knowledge so i can someday(hopefully within few months) be able to join the reverse engineering community, probably in the anti-virus/defense field. i was wondering, since ...
1
vote
0answers
92 views

How to hook eval function in node.js

As the eval() function of JavaScript is an evil, I want to hook or monkey-patch eval() function of JavaScript in node.js. I want to intercept all arguments passed in eval() function. Please guide me ...
0
votes
0answers
140 views

Reversing a Windows service - Debug with x64dbg

For a school project I need to hook the function of the Windows spooler that is used to create a printing job with the path of the document to be printed. For that I setup a function trampoline (this ...
0
votes
1answer
124 views

Function Hooking via Dll Injection Negative Offset

I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to ...
1
vote
1answer
514 views

Hooking function with frida

How can i hook functions with frida? Can someone give me an example please, for something that do that? Hook at 0x412312 and change the assembly code to "mov eax, 999" I Arleady tried something like:...
2
votes
2answers
987 views

Patching JNZ (two byte opcode) into JMP near (one byte opcode)?

I've been tinkering with Fallout New Vegas, and have focused on modifying a very simple record that's hardcoded in the game engine. It's called an Imagespace Modifier, which is a very basic shader ...
0
votes
0answers
186 views

How Do i create a simple Detour Library

Quite new to Reverse Engineering and making Detour Functions, Just need some form of clarification here, i am trying to make a Simple x86 Detour library and i have worked on something using some ...
0
votes
0answers
144 views

x64 hook Fails on Messagebox

Quite new to the intels so i might not know much , I just need some form of direction here. I am trying to do a simple 64 bit hook detour for function hooking I do it like so : The detour hook ...
0
votes
1answer
125 views

Executing CMP DS:[] by inline assembly inline hooks

I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction. Followed by IDA, this instruction is: cmp off_41AE7048, ...
1
vote
1answer
108 views

Why does vmt hooking not work with instance member in the following case?

Why does the function not get hooked when called with instance member obj.myFunc() ? class Myclass { public: virtual void myFunc() = 0; }; class Derived : public Myclass { public: void ...
0
votes
1answer
58 views

Finding “controller vibration” function in game

I want to build a "force feedback chair" for Need for Speed: Payback, so I thought about hooking the function responsible for the controller vibration and sending the motor speed parameter to a motor ...
2
votes
0answers
3k views

How to step to specific function call?

I'm reverse engineering an application and I identified a specific function call that has an output that I need to capture. For the actual capture, I'll do a memory dump, so that I can handle. However,...
4
votes
4answers
3k views

Calculation of jmp address through subtraction

I don't get why the two addresses of the functions are subtracted in order to get the jump destination. mov eax, [ebp+func1] sub eax, [ebp+func2] sub eax, 5 mov [ebp+var_4], eax Which ...
2
votes
1answer
624 views

Trying to hook DirectX9 using C++ - Keeps crashing

I posted a thread on StackOverflow a few days ago, and it's got little attention, so i though it's possible this might be a better place for it. As the title says, i'm trying to hook/detour DirectX9 ...
1
vote
1answer
77 views

Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?

I am studying assembly and hooking. I know how to hook x86 assembly now. so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function. I think ...
2
votes
0answers
743 views

frida hook jni not work

I want to trace Android Telegram app(open-source) to learn its protocol. From the source code these two functions AES_set_encrypt_key and AES_ctr128_encrypt are used to do the encryption, and I can ...
1
vote
0answers
518 views

How to hook into OpenSSL shared library?

To preface, I am not a well-versed developer in the whole business of reverse engineering or even most basic programming. This is a project I made with the goal of attempting to replicate an existing ...
-1
votes
1answer
206 views

Hooking flash player dll

Lately I came to game-bot for browser flash-game which gets data from flashplayer dll. The main point of doing this was to get decrypted data(JSON) sent from game server to client through TCP. Do ...
2
votes
1answer
839 views

How to override c++ string class with LD_PRELOAD

i am trying to override predefined functions such as strcmp, getenv, etc. i already override some of them using LD_PRELOAD options. but i can't override string class, how can i override c++ string ...
0
votes
1answer
305 views

Reversing: DeviceIoControl return value

While reverse engineering a windows executable I found the DeviceIoControl function, and i'm trying to figure out the correct inputs so it does not return a zero, it get's the [ebp+hDevice] from the ...
1
vote
0answers
372 views

Hook function in Linux SO file

I'm working on reverse engineering an Android application where the native code opens TLS connections using a built-in copy of mbedtls with certificate pinning. I'd like to decrypt that traffic and ...
2
votes
1answer
494 views

Hooking function with C++, IDA and .pdb file

I want to call a function in a program. I do this from a DLL entry point. I opened the program in IDA together with its .pdb file. This is what the function looks like according to IDA: void ...
3
votes
3answers
9k views

print [B byte array in frida js script

I'm learning frida and trying to hook a function that looks like: `.method public final fn()[B` It returns a byte array. Here's my code: Java.perform(function () { var test = Java.use("com...");...
1
vote
2answers
692 views

hooking sleep & beep syscalls

I have a binary which is playing a Morse code using calls to Beep & Sleep. This file is Windows PE32 exe which I open via Wine on my Ubuntu (16.04). How can I extract the arguments which passed ...
-1
votes
1answer
3k views

How to add code to compiled java class

I have java code that is compiled to a .class file. There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y) I want to add to this .class file code that ...
1
vote
0answers
132 views

Call again function with new parameters

I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
0
votes
1answer
128 views

Help with anti-disassembly trick inside a hooked function

I am trying to understand a hook installed by a program within the Win32 API function ZwWriteVirtualMemory. It seems that a jmp inside an instruction is used and I couldn't fix it to be able to ...
-1
votes
1answer
321 views

Addresses of dlls in Kernel Space

I wrote a code that hooks the SSDT. Currently I can hook functions exported only from ntdll: NtCreateFile, NtClose etc. since they are the only ones that have entries in SSDT. I wanna know if there is ...
2
votes
0answers
230 views

Calling original function that uses unconventional calling convention

I'm using MinHook to hook a static function with the following signature: float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
0
votes
2answers
873 views

Calling a function of a game inside a function hook

How can you call a game function inside a function hook? For example, I hooked the recv function of winsock. Then, I examined a packet. This packet has the value of my current hp. I check the hp. If ...
0
votes
2answers
2k views

Ways to detect Function hooking?

I making a game and I'm trying to find a way to prevent against function hooking (IAT/VMT/etc), or at the least detect it, I understand how they work but dont see a very reliable way to detect or ...
1
vote
1answer
116 views

How to get the address of a function definition?

So im wondering how i can retrieve the adress of the definition instead of the adress of the declaration via dereferencing the startaddress of a c++ function. To be more concrete: My function to ...
0
votes
1answer
100 views

Finding What Data Means From File?

I have a file with the extension of "TOC" I assumed it meant Table of Contents, and the contents of said file represent that it indeed is one. It's full of content such as this: 117dbdd0 15 ...
0
votes
2answers
525 views

How can I get the process information in windows without using APIs?

I want to write a program to obtain the information of process, for the purpose of detecting and combating malware. I can use C++ and Win32 APIs to finish it, but I then started suspecting those APIs ...
0
votes
2answers
1k views

Add new subroutine using IDA for ARM binary

I am trying to recreate a patch for an ARM binary. As it shows in attached picture, I have provided the before and after sections of file. In patched file, a new subroutine is added in a cave, and ...