Questions tagged [function-hooking]
Correspond to all the techniques used to intercept function calls and to attach a piece of code before or/and after the execution of the function itself.
114 questions
-1
votes
0
answers
37
views
Looking for DLL source code for spawning vehicles in GTA III [closed]
Can anyone write a DLL source code for spawning vehicles in GTA III, please? ChatGPT doesn't help me.
1
vote
0
answers
21
views
Inject DLLs into Xbox 360 games with Xenia
Is it possible to inject custom DLLs into Xbox 360 games with Xenia?
0
votes
0
answers
40
views
Extending a Struct in a Compiled Executable
I'm currently extending an existing compiled executable (32 bit) using DLL proxying. My goal is to add a new member to a struct that exists in the original executable. For that, I modify the original ...
- 1
1
vote
1
answer
103
views
Finding entrypoints (native functions) in games/programs
I'm working on a personal project involving reverse engineering a game executable to hook specific functions. The goal is to create a modding framework similar to ScriptHookV for GTA5 or F4SE for ...
- 11
1
vote
0
answers
65
views
How to hook or call "non-native/non-exported functions"?
I wrote this simple application in C++ to learn about reverse engineering:
#include <iostream>
#include <windows.h>
void PrintMessage(const char *message) {
std::cout << message ...
- 11
0
votes
0
answers
32
views
How to trigger calls and attach to functions on a running process?
I'm a software developer, with some knowledge in memory management but near zero experience in reverse engineering. I wonder if there is a way to detect which function a program calls at certain ...
- 11
0
votes
1
answer
47
views
Hook: can call string::size() but crashing when reading string data... how to read without crash?
I'm hooking a function that reads and decrypt files and my idea is to read the buffer once it's decrypted:
typedef void(__thiscall* _readFileContents)(DWORD* _resourceManager, std::string* buffer, std:...
- 161
0
votes
0
answers
43
views
How does it calculate a backup checksum
in Ghidra I found a function that calculates a checksum and checks it against a checksum in a protobuf I'm stuck in this function for days and I tried using frida to get the ret value
but it doesn't ...
- 1
1
vote
0
answers
400
views
Read value from frida hooked native method Jlong parameter
I am new to using frida for hooking native android code i.e lib.so, so I have load the lib into ghidra and can find the native function. the native function is getting 5 params including jnienv and ...
- 309
1
vote
0
answers
35
views
Anyway to hook to change file content and return for application keep read it?
is there anyway to modify v2 before statement if(v2) happen?
- 11
3
votes
0
answers
132
views
How can I find out which system functions are used in applications using dynamic loading?
I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours ...
- 31
2
votes
0
answers
210
views
How can I detect which Android native function that is hooked by Mobile Substrate: MSHookFunction?
I want to detect hook behavior of MSHookFunction on Android. This is Mobile Substrate I use in my test app https://github.com/Breathleas/Android-Hooking-Template-Cydia-Substrate/tree/master/jni/...
- 121
2
votes
0
answers
163
views
statically placing hooks on PE file's IAT
recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully ...
- 21
1
vote
0
answers
172
views
problem with hooking __usercall function and asm code
I need a hook function with the __usercall convention.
I already hooked functions that were defined as __usercall and __userpurge, but this time it's __usercall with arguments that are also passed ...
- 11
2
votes
0
answers
53
views
Redirect exception handler?
I'm working on a localization project and have a few trampoline hooks to translate some text in an online game. Periodically throughout gameplay, there are checks that run in the background to ensure ...
1
vote
0
answers
75
views
Is there any Android application that can manipulate the http response?
Is there any android app to manipulate http response body without vpn?
for example:
from
"0|{random_string}|Wrong"
Becomes
"1|{random_string}|True"
Thanks in advance
- 11
2
votes
0
answers
1k
views
How can I enumerate and hook all non-exported functions in lib.so using frida?
I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported ...
- 309
1
vote
0
answers
116
views
Problem to hook a parameter with _thiscall function
I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function:
.text:00488DA0 ; =============== S U B R O U T I N E ==========================...
- 289
1
vote
0
answers
129
views
SetPixel seem not work on some external window
I have succefully hooked a game and I need to do read and write with GetPixel and SetPixel to the game window.
To do a test I have created this code:
Here my hooked function:
My_hooked_function(int a3)...
- 289
2
votes
1
answer
524
views
How to hook to a system function
How to hook to external library function, such as OpenGL for example.
I have a function used by the program I am trying to change behaviour of. The function is:
lVar17 = glfwCreateWindow(uVar22,uVar25,...
- 328
3
votes
3
answers
1k
views
IAT Hook via Kernel Driver
I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver.
I want to hook the IAT of another driver from my driver if that makes sense.
So I ...
- 49
0
votes
2
answers
366
views
How to declare a constructor in reversed class?
I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address.
It is declared like this:
game.h
namespace ...
- 328
1
vote
1
answer
335
views
Using struct objects and constructors in hooked function
Will try to reword the actual question so it is hopefully more descriptive and clear of what I am after:
So, there is a function main, which I have successfully hooked. The hooked version looks like ...
- 328
2
votes
1
answer
494
views
Hooking IAT in remote process with Python?
I'm trying to hook a win32 function call (CreateFileW) inside of a notepad process to have the function do additional actions before returning what it should do. Ultimately, this will assist me in ...
- 51
1
vote
1
answer
163
views
Inconsistency in function addresses of the hooked functions (address shift)
I came across "a strange" inconsistency in terms of the function addresses in the particular application.
First, the main function is hooked successfully, the address is derived in a fashion:...
- 328
1
vote
1
answer
1k
views
DetourAttach breaks with Illegal Instruction 0xC000001D
I am trying to detour a function using DetourAttach() in the following fashion:
hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
- 328
2
votes
2
answers
342
views
Adding a hook to the end of a function
I have a (so-called) function with multiple entry points but only one ret.
I am trying to understand how to add a hook to the function.
The main problem I'm facing is the code that is placed right ...
- 121
2
votes
0
answers
121
views
Cant hook into native lib with script?
im doing some practice stuff about hooking android native lib. I wrote this script:
function processJniOnLoad(libraryName) {
const funcSym = "...
- 67
1
vote
2
answers
269
views
Using IAT Hooking to hook end of function
Is it possible? Maybe you can explain it with a simple example if that's possible?
- 11
0
votes
0
answers
102
views
finding a not-so-straightforward game's function
I am working on Mad Max game [ APEX engine ]
I do my best to explain the situation.
so my target executes function like this:
there are commands like " call [eax+XX] " or " call RX &...
- 51
3
votes
2
answers
2k
views
Frida reading files is slow
I need to read a file around 2 MB into a byte array.
var fis = Java.use("java.io.FileInputStream");
var file = fis.$new("/data/local/file.txt");
var fileBytes = new Uint8Array(file....
- 176
1
vote
0
answers
88
views
Why do some antiviruses hook x64 Ntdll in WOW64 process?
Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.
- 131
1
vote
1
answer
322
views
Hook naked function with CPU registers
I need to hook this function:
.text:005589CB sub_5589CB proc near ; CODE XREF: AddHealth(int,long)+1A↑j
.text:005589CB ; sub_5328D8+98E↑p ...
...
- 289
1
vote
0
answers
642
views
Miasm VS Triton - which to choose? [closed]
Hello and thank you for reading my question,
I was wondering, which is the right tool for me to choose according to the following:
I will be using it mainly for Malware analysis and for exploit ...
- 11
2
votes
1
answer
501
views
How use signature pattern for hooking
I like to replace the static function address:
AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer)
using signature pattern:
SigScan ...
- 289
1
vote
1
answer
252
views
Function pointer reference
I need to hook 10/20 functions like these:
static void* __cdecl HookFunction1(char *FileName, int a2, int a3, int a4);
__declspec(naked) void HookFunction2(char *Src, int pedx, int
a3, ...
- 289
0
votes
1
answer
299
views
modern instrumentation for reversing and researching [closed]
i am really glad i found this great site and wanted to ask from your expertise regarding the following issue:
i have been doing malware analysis and researching for a few years, and i want to learn ...
- 1
1
vote
1
answer
890
views
how to hook __usercall function with microsoft detours
I need to hook a __usercall function in particular I need to read only the first parameter:
char __usercall sub_4F3E6D@<al>(char *Src@<ecx>, int a2@<edx>, int a3, int a4, char a5, ...
- 289
1
vote
0
answers
177
views
Easy way to attach a DLL to a Game
I like to attach a dll to a game to add more features.
The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game.
My idea is use this technique:
dinput_ori.dll (...
- 289
1
vote
0
answers
147
views
Alternative to MS Detours (32 bit)
I have used MS Detours for one project in c++ and work perfectly.
I have created a clone of this application (95% of the some code) to hook another file (a GOG game with DRM free), but this time crash ...
- 289
0
votes
0
answers
147
views
What's the way to find a function on a unity game and how I call it after I find?
I'm a newbye, so sorry for the basic questions, before anyone downvote the question.
I'm Learning reverse engineering, I've already learned assembly for mips on the computer science underdegree and I ...
- 1
0
votes
0
answers
228
views
Crash after hook a function
I have hooked a sound function that work within the game menu after, when the battle start, the game will crash.
The function at the first parameter get correctly the sound file name, before the ...
- 289
1
vote
1
answer
537
views
frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?
I wanted to hook the method A1f in the below code but frida returns the following exceptions:
Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)}
java.lang....
- 309
0
votes
1
answer
806
views
best approach to hook function
I have found 2 source code example to hook a function.
Example1:
#include "detours.h"
#include "sigscan.h"
// this is the function that the program
// will jump to when sum() is ...
- 289
0
votes
0
answers
536
views
DLL injection (Failed to inject)
I have found this complete and easy example to test the function hook:
https://github.com/Zer0Mem0ry/Detour
#include <Windows.h>
#include <iostream>
#include "detours.h"
#...
- 289
3
votes
0
answers
250
views
How are single-player games made into multiplayer ones? [closed]
I was always curious about how some single-player games are turned into multiplayer ones. Some samples are SA-MP and MTA, that turn Grand Theft Auto: San Andreas into a multiplayer game.
In an ...
- 131
1
vote
0
answers
143
views
what are modern hooking techniques? [closed]
i was looking at interesting anti malware roles (malware analysis and prevention) and among the required skills they mentioned that "modern hooking techniques" should be well acquainted with. i was ...
- 86
4
votes
1
answer
318
views
Where do mouse/keyboard GUI inputs get queued or stored?
Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing?
I'm wondering if it'd be possible ...
- 169
1
vote
1
answer
388
views
Detours not cleaning the stack correctly
I'm trying to hook a function using Detours for the first time. I'm new to reversing software and to hooking, so I may have missed something big here.
I'm trying to use this function as a hook:
...
- 197
2
votes
1
answer
449
views
Hiding a file in a Windows operating system
I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis.
What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
- 21