Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [function-hooking]

Correspond to all the techniques used to intercept function calls and to attach a piece of code before or/and after the execution of the function itself.

0
votes
0answers
43 views

x64 hook Fails on Messagebox

Quite new to the intels so i might not know much , I just need some form of direction here. I am trying to do a simple 64 bit hook detour for function hooking I do it like so : The detour hook ...
0
votes
1answer
61 views

Executing CMP DS:[] by inline assembly inline hooks

I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction. Followed by IDA, this instruction is: cmp off_41AE7048, ...
1
vote
1answer
61 views

Why does vmt hooking not work with instance member in the following case?

Why does the function not get hooked when called with instance member obj.myFunc() ? class Myclass { public: virtual void myFunc() = 0; }; class Derived : public Myclass { public: void ...
0
votes
1answer
43 views

Finding “controller vibration” function in game

I want to build a "force feedback chair" for Need for Speed: Payback, so I thought about hooking the function responsible for the controller vibration and sending the motor speed parameter to a motor ...
1
vote
0answers
756 views

How to step to specific function call?

I'm reverse engineering an application and I identified a specific function call that has an output that I need to capture. For the actual capture, I'll do a memory dump, so that I can handle. However,...
4
votes
4answers
1k views

Calculation of jmp address through subtraction

I don't get why the two addresses of the functions are subtracted in order to get the jump destination. mov eax, [ebp+func1] sub eax, [ebp+func2] sub eax, 5 mov [ebp+var_4], eax Which ...
2
votes
1answer
184 views

Trying to hook DirectX9 using C++ - Keeps crashing

I posted a thread on StackOverflow a few days ago, and it's got little attention, so i though it's possible this might be a better place for it. As the title says, i'm trying to hook/detour DirectX9 ...
1
vote
1answer
61 views

Is there any way to call function instead of breakpoint, when certain memory area is accessed or register value is matched?

I am studying assembly and hooking. I know how to hook x86 assembly now. so if any thread goes to certain address which is overwritten with my code, it automatically returns to my function. I think ...
2
votes
0answers
379 views

frida hook jni not work

I want to trace Android Telegram app(open-source) to learn its protocol. From the source code these two functions AES_set_encrypt_key and AES_ctr128_encrypt are used to do the encryption, and I can ...
1
vote
0answers
266 views

How to hook into OpenSSL shared library?

To preface, I am not a well-versed developer in the whole business of reverse engineering or even most basic programming. This is a project I made with the goal of attempting to replicate an existing ...
-1
votes
1answer
177 views

Hooking flash player dll

Lately I came to game-bot for browser flash-game which gets data from flashplayer dll. The main point of doing this was to get decrypted data(JSON) sent from game server to client through TCP. Do ...
2
votes
1answer
400 views

How to override c++ string class with LD_PRELOAD

i am trying to override predefined functions such as strcmp, getenv, etc. i already override some of them using LD_PRELOAD options. but i can't override string class, how can i override c++ string ...
0
votes
1answer
137 views

Reversing: DeviceIoControl return value

While reverse engineering a windows executable I found the DeviceIoControl function, and i'm trying to figure out the correct inputs so it does not return a zero, it get's the [ebp+hDevice] from the ...
1
vote
0answers
235 views

Hook function in Linux SO file

I'm working on reverse engineering an Android application where the native code opens TLS connections using a built-in copy of mbedtls with certificate pinning. I'd like to decrypt that traffic and ...
2
votes
1answer
254 views

Hooking function with C++, IDA and .pdb file

I want to call a function in a program. I do this from a DLL entry point. I opened the program in IDA together with its .pdb file. This is what the function looks like according to IDA: void ...
2
votes
1answer
3k views

print [B byte array in frida js script

I'm learning frida and trying to hook a function that looks like: `.method public final fn()[B` It returns a byte array. Here's my code: Java.perform(function () { var test = Java.use("com...");...
1
vote
2answers
396 views

hooking sleep & beep syscalls

I have a binary which is playing a Morse code using calls to Beep & Sleep. This file is Windows PE32 exe which I open via Wine on my Ubuntu (16.04). How can I extract the arguments which passed ...
-1
votes
1answer
1k views

How to add code to compiled java class

I have java code that is compiled to a .class file. There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y) I want to add to this .class file code that ...
1
vote
0answers
114 views

Call again function with new parameters

I developing online game. I have full sources for server, but game client I am using is closed-source so I need to do some reverse engineering there. So for 2 weeks I am trying to properly call ...
0
votes
1answer
118 views

Help with anti-disassembly trick inside a hooked function

I am trying to understand a hook installed by a program within the Win32 API function ZwWriteVirtualMemory. It seems that a jmp inside an instruction is used and I couldn't fix it to be able to ...
-1
votes
1answer
237 views

Addresses of dlls in Kernel Space

I wrote a code that hooks the SSDT. Currently I can hook functions exported only from ntdll: NtCreateFile, NtClose etc. since they are the only ones that have entries in SSDT. I wanna know if there is ...
2
votes
0answers
132 views

Calling original function that uses unconventional calling convention

I'm using MinHook to hook a static function with the following signature: float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
1
vote
2answers
492 views

Calling a function of a game inside a function hook

How can you call a game function inside a function hook? For example, I hooked the recv function of winsock. Then, I examined a packet. This packet has the value of my current hp. I check the hp. If ...
0
votes
2answers
988 views

Ways to detect Function hooking?

I making a game and I'm trying to find a way to prevent against function hooking (IAT/VMT/etc), or at the least detect it, I understand how they work but dont see a very reliable way to detect or ...
1
vote
1answer
71 views

How to get the address of a function definition?

So im wondering how i can retrieve the adress of the definition instead of the adress of the declaration via dereferencing the startaddress of a c++ function. To be more concrete: My function to ...
0
votes
1answer
84 views

Finding What Data Means From File?

I have a file with the extension of "TOC" I assumed it meant Table of Contents, and the contents of said file represent that it indeed is one. It's full of content such as this: 117dbdd0 15 ...
0
votes
2answers
390 views

How can I get the process information in windows without using APIs?

I want to write a program to obtain the information of process, for the purpose of detecting and combating malware. I can use C++ and Win32 APIs to finish it, but I then started suspecting those APIs ...
0
votes
2answers
724 views

Add new subroutine using IDA for ARM binary

I am trying to recreate a patch for an ARM binary. As it shows in attached picture, I have provided the before and after sections of file. In patched file, a new subroutine is added in a cave, and ...
3
votes
2answers
775 views

Modifying Windows DLLs

I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return True every time a specific program calls IsDebuggerPresent, ...
0
votes
1answer
442 views

It's possible call a function outside a original thread?

Example: I have a function in a process on the memory address: 0xABCDEF, but that function cannot be called outside of original thread, it's possible to call it or hook it somehow? To what i'm going ...
2
votes
0answers
276 views

What encryption/compression is this, and how to encode/decode from it?

I've been trying to reverse engineer an Android app's communication protocol using a combination of Xposed and Packet sniffing. Most of the packets the app sends have this header set: Content-Type: ...
2
votes
1answer
318 views

How do I call a statically imported function from a Dll? call dword ptr ds <> not working

Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call. Now I actually want to do things with a ...
0
votes
1answer
127 views

Possible to hook an address and directly write to it?

I am reversing a game for fun and currently use this function to manipulate the Y coordinate: void __declspec(naked) hookYCoordASM() { __asm { mov eax, valueY mov [esi + 0x7C], ...
0
votes
1answer
772 views

Reverse Engineering Exported DLL Function

I am trying to read the arguments sent to an external dll file "FlashToolLib.dll". My hook function is never triggered, I am guessing because I have the address wrong. I have tried the address in ...
1
vote
3answers
738 views

Winapi ReadFile monitor

I'm trying to make a small proxy dll that will be able to print out all the files that a game tries to access from disk. I'm using a dinput8 wrapper dll as my proxy dll, from where I've managed to ...
0
votes
1answer
689 views

Inline assembly does not compile [closed]

I am currently learning how to hook some functions, and I simply want to insert this simple inline assembly: __asm { CMP [ebp + 8], 1 JNZ short 01311723 jmp [jmpBackAddy] } But Visual ...
1
vote
1answer
543 views

Can this method be hooked in iOS?

Here's IDA: http://pastebin.com/AkU0MDWh Also, would this be written in C to show like this? In comparison to a regular method like: ListRowCell - (id)initWithStyle:(int) reuseIdentifier:(id)
0
votes
2answers
167 views

MSDetour not detouring SHGetKnownFolderPath

Tried to hook SHGetKnownFolderPath from shell32, using the normal DetourFunctionWithTrampoline, and it could not. Investigating, it seen that the application use GetProcAddress to load the function, ...
0
votes
1answer
133 views

Hooking offset from IDA throws Access Violation

I've been trying to hook a function using Detours 1.5, but when DetourFunction() is called, it throws access violation. This is the original function: int greeter(char *name) { printf_s("%s, %s!\...
1
vote
1answer
156 views

Problem finding correct offset in simple program with IDA Pro

I've been studying about clienthooks and made a simple program to be manipulated with dll injection #include "stdafx.h" typedef char greet_t[16]; greet_t greetings[] = { "Hello", "Hi", "...
2
votes
1answer
233 views

Hooking in Immunity - LogBpHook not working

I try to use a simple hook on different memory allocation functions in Immunity. But the hook doesn't react at all (no logging). First of all my hook class: class AllocHook(LogBpHook): def ...
1
vote
1answer
166 views

How would I go about getting an application's XMPP request before it is SSL-encrypted?

Disclaimer: I am very new to Reverse Engineering, though it captivates me. Hence, I'm apologizing beforehand if I say anything ridiculous in the following, and hope you will help me find the way! ...
2
votes
1answer
86 views

What is an easy way to update the addresses of hooked functions in an exe

I have hooked into some functions in an exe. I was wondering if there were any simple ways to detect the memory addresses of these functions after the exe has a new build (not my exe). Is the best way ...
0
votes
1answer
171 views

Detour null function

I've been trying to detour a nullsub, this function is used with log purposes, but as the program is compiled under release flags it got removed and I'd like to restore it. IDA reports as follow: ....
1
vote
1answer
1k views

iOS Detect Function Hooking

I would like to find out if there's a way to detect if a C function is hooked in iOS? So for example let's say I hook SSLHandshake, OSStatus (*orig_SSLHandshake) (SSLContextRef context); OSStatus ...
5
votes
1answer
262 views

Static Address in Dynamically Loaded DLL

I am trying to re-write the following function in my injected DLL. mov edi,edi push ebp mov ebp,esp mov eax, [sound.dll+1AE0] push eax mov ecx,[ebp+08] mov eax,[ecx] mov eax,[eax+0C] push eax call ...
3
votes
2answers
539 views

Why hook a function rather than set a breakpoint

I know hooking is usually used as a technique when one would rather use external (or injected) code to manipulate an executable, vs breakpoints which are usually set by a debugging framework in an ...
1
vote
0answers
313 views

Resources for API Hooking and DLL Injection

What are great resources and essential skills needed to become a proficient reverse engineer regarding API Hooking and DLL Injection? I would like to use a comprehensive book instead of scattered ...
0
votes
1answer
280 views

Instrumenting syscall by static binary rewriting

(The problem is updated... as the investigation goes deep) My goal is to intercept all syscalls originated from a shared object file. The requirement is not to modify the kernel code (e.g. can not ...
1
vote
1answer
107 views

Distinguish between local function calls and external(imported) function calls in a dynamic trace

I know that when IDA pro want to disassemble a binary and label the functions, employs import address table and IDA flirt to distinguish from local functions and external functions! Now I have ...