Skip to main content

Questions tagged [function-hooking]

Correspond to all the techniques used to intercept function calls and to attach a piece of code before or/and after the execution of the function itself.

Filter by
Sorted by
Tagged with
1 vote
1 answer
446 views

Addresses of dlls in Kernel Space

I wrote a code that hooks the SSDT. Currently I can hook functions exported only from ntdll: NtCreateFile, NtClose etc. since they are the only ones that have entries in SSDT. I wanna know if there is ...
0 votes
1 answer
276 views

Hooking flash player dll

Lately I came to game-bot for browser flash-game which gets data from flashplayer dll. The main point of doing this was to get decrypted data(JSON) sent from game server to client through TCP. Do ...
1 vote
1 answer
236 views

Function pointer reference

I need to hook 10/20 functions like these: static void* __cdecl HookFunction1(char *FileName, int a2, int a3, int a4); __declspec(naked) void HookFunction2(char *Src, int pedx, int a3, ...
0 votes
2 answers
351 views

How to declare a constructor in reversed class?

I wonder how to declare the reference to a constructor to a reversed class, i.e. I have a class say Game and it has a constructor at a certain address. It is declared like this: game.h namespace ...
1 vote
0 answers
56 views

How to hook or call "non-native/non-exported functions"?

I wrote this simple application in C++ to learn about reverse engineering: #include <iostream> #include <windows.h> void PrintMessage(const char *message) { std::cout << message ...
0 votes
0 answers
28 views

How to trigger calls and attach to functions on a running process?

I'm a software developer, with some knowledge in memory management but near zero experience in reverse engineering. I wonder if there is a way to detect which function a program calls at certain ...
4 votes
1 answer
2k views

Hooking function with frida

How can i hook functions with frida? Can someone give me an example please, for something that do that? Hook at 0x412312 and change the assembly code to "mov eax, 999" I Arleady tried something like:...
0 votes
1 answer
45 views

Hook: can call string::size() but crashing when reading string data... how to read without crash?

I'm hooking a function that reads and decrypt files and my idea is to read the buffer once it's decrypted: typedef void(__thiscall* _readFileContents)(DWORD* _resourceManager, std::string* buffer, std:...
0 votes
0 answers
42 views

How does it calculate a backup checksum

in Ghidra I found a function that calculates a checksum and checks it against a checksum in a protobuf I'm stuck in this function for days and I tried using frida to get the ret value but it doesn't ...
4 votes
5 answers
24k views

print [B byte array in frida js script

I'm learning frida and trying to hook a function that looks like: `.method public final fn()[B` It returns a byte array. Here's my code: Java.perform(function () { var test = Java.use("com...");...
1 vote
0 answers
381 views

Read value from frida hooked native method Jlong parameter

I am new to using frida for hooking native android code i.e lib.so, so I have load the lib into ghidra and can find the native function. the native function is getting 5 params including jnienv and ...
1 vote
0 answers
33 views

Anyway to hook to change file content and return for application keep read it?

is there anyway to modify v2 before statement if(v2) happen?
3 votes
0 answers
131 views

How can I find out which system functions are used in applications using dynamic loading?

I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours ...
1 vote
2 answers
260 views

Using IAT Hooking to hook end of function

Is it possible? Maybe you can explain it with a simple example if that's possible?
2 votes
0 answers
197 views

How can I detect which Android native function that is hooked by Mobile Substrate: MSHookFunction?

I want to detect hook behavior of MSHookFunction on Android. This is Mobile Substrate I use in my test app https://github.com/Breathleas/Android-Hooking-Template-Cydia-Substrate/tree/master/jni/...
1 vote
0 answers
172 views

Easy way to attach a DLL to a Game

I like to attach a dll to a game to add more features. The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game. My idea is use this technique: dinput_ori.dll (...
2 votes
0 answers
155 views

statically placing hooks on PE file's IAT

recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully ...
1 vote
0 answers
166 views

problem with hooking __usercall function and asm code

I need a hook function with the __usercall convention. I already hooked functions that were defined as __usercall and __userpurge, but this time it's __usercall with arguments that are also passed ...
2 votes
0 answers
53 views

Redirect exception handler?

I'm working on a localization project and have a few trampoline hooks to translate some text in an online game. Periodically throughout gameplay, there are checks that run in the background to ensure ...
1 vote
0 answers
75 views

Is there any Android application that can manipulate the http response?

Is there any android app to manipulate http response body without vpn? for example: from "0|{random_string}|Wrong" Becomes "1|{random_string}|True" Thanks in advance
2 votes
0 answers
1k views

How can I enumerate and hook all non-exported functions in lib.so using frida?

I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported ...
1 vote
0 answers
109 views

Problem to hook a parameter with _thiscall function

I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function: .text:00488DA0 ; =============== S U B R O U T I N E ==========================...
11 votes
3 answers
1k views

What methodology can be used to change code flow atomically during program execution?

I have been reading a lot about the different techniques for Windows API hooking (a technique I'm particularly fascinated by and fond of), and it seems a major problem in implementing a realiable ...
3 votes
3 answers
2k views

Modifying Windows DLLs

I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return True every time a specific program calls IsDebuggerPresent, ...
1 vote
0 answers
121 views

SetPixel seem not work on some external window

I have succefully hooked a game and I need to do read and write with GetPixel and SetPixel to the game window. To do a test I have created this code: Here my hooked function: My_hooked_function(int a3)...
2 votes
1 answer
492 views

How use signature pattern for hooking

I like to replace the static function address: AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer) using signature pattern: SigScan ...
1 vote
1 answer
530 views

frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?

I wanted to hook the method A1f in the below code but frida returns the following exceptions: Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)} java.lang....
2 votes
1 answer
515 views

How to hook to a system function

How to hook to external library function, such as OpenGL for example. I have a function used by the program I am trying to change behaviour of. The function is: lVar17 = glfwCreateWindow(uVar22,uVar25,...
3 votes
3 answers
1k views

IAT Hook via Kernel Driver

I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver. I want to hook the IAT of another driver from my driver if that makes sense. So I ...
1 vote
1 answer
330 views

Using struct objects and constructors in hooked function

Will try to reword the actual question so it is hopefully more descriptive and clear of what I am after: So, there is a function main, which I have successfully hooked. The hooked version looks like ...
5 votes
0 answers
381 views

Static Address in Dynamically Loaded DLL

I am trying to re-write the following function in my injected DLL. mov edi,edi push ebp mov ebp,esp mov eax, [sound.dll+1AE0] push eax mov ecx,[ebp+08] mov eax,[ecx] mov eax,[eax+0C] push eax call ...
1 vote
1 answer
157 views

Inconsistency in function addresses of the hooked functions (address shift)

I came across "a strange" inconsistency in terms of the function addresses in the particular application. First, the main function is hooked successfully, the address is derived in a fashion:...
2 votes
1 answer
491 views

Hooking IAT in remote process with Python?

I'm trying to hook a win32 function call (CreateFileW) inside of a notepad process to have the function do additional actions before returning what it should do. Ultimately, this will assist me in ...
1 vote
1 answer
1k views

DetourAttach breaks with Illegal Instruction 0xC000001D

I am trying to detour a function using DetourAttach() in the following fashion: hooks::logDebug("swresample-3Proxy.log", fmt::format("Try to attach hook. Function {:p}, hook {:p}.",...
2 votes
2 answers
338 views

Adding a hook to the end of a function

I have a (so-called) function with multiple entry points but only one ret. I am trying to understand how to add a hook to the function. The main problem I'm facing is the code that is placed right ...
4 votes
1 answer
317 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
2 votes
0 answers
120 views

Cant hook into native lib with script?

im doing some practice stuff about hooking android native lib. I wrote this script: function processJniOnLoad(libraryName) { const funcSym = "...
0 votes
0 answers
99 views

finding a not-so-straightforward game's function

I am working on Mad Max game [ APEX engine ] I do my best to explain the situation. so my target executes function like this: there are commands like " call [eax+XX] " or " call RX &...
3 votes
2 answers
2k views

Frida reading files is slow

I need to read a file around 2 MB into a byte array. var fis = Java.use("java.io.FileInputStream"); var file = fis.$new("/data/local/file.txt"); var fileBytes = new Uint8Array(file....
1 vote
0 answers
87 views

Why do some antiviruses hook x64 Ntdll in WOW64 process?

Why do some antiviruses hook x64 Ntdll in WOW64 process? However, the same antiviruses do not hook Ntdll in the native x64 processes.
1 vote
1 answer
382 views

Detours not cleaning the stack correctly

I'm trying to hook a function using Detours for the first time. I'm new to reversing software and to hooking, so I may have missed something big here. I'm trying to use this function as a hook: ...
1 vote
1 answer
319 views

Hook naked function with CPU registers

I need to hook this function: .text:005589CB sub_5589CB proc near ; CODE XREF: AddHealth(int,long)+1A↑j .text:005589CB ; sub_5328D8+98E↑p ... ...
1 vote
0 answers
613 views

Miasm VS Triton - which to choose? [closed]

Hello and thank you for reading my question, I was wondering, which is the right tool for me to choose according to the following: I will be using it mainly for Malware analysis and for exploit ...
0 votes
1 answer
297 views

modern instrumentation for reversing and researching [closed]

i am really glad i found this great site and wanted to ask from your expertise regarding the following issue: i have been doing malware analysis and researching for a few years, and i want to learn ...
1 vote
2 answers
10k views

How to add code to compiled java class

I have java code that is compiled to a .class file. There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y) I want to add to this .class file code that ...
1 vote
1 answer
875 views

how to hook __usercall function with microsoft detours

I need to hook a __usercall function in particular I need to read only the first parameter: char __usercall sub_4F3E6D@<al>(char *Src@<ecx>, int a2@<edx>, int a3, int a4, char a5, ...
1 vote
0 answers
145 views

Alternative to MS Detours (32 bit)

I have used MS Detours for one project in c++ and work perfectly. I have created a clone of this application (95% of the some code) to hook another file (a GOG game with DRM free), but this time crash ...
0 votes
0 answers
145 views

What's the way to find a function on a unity game and how I call it after I find?

I'm a newbye, so sorry for the basic questions, before anyone downvote the question. I'm Learning reverse engineering, I've already learned assembly for mips on the computer science underdegree and I ...
0 votes
0 answers
227 views

Crash after hook a function

I have hooked a sound function that work within the game menu after, when the battle start, the game will crash. The function at the first parameter get correctly the sound file name, before the ...
8 votes
2 answers
7k views

Hooking Java APIs

In native code on windows functions can be hooked by replacing their prologue with a JMP instruction. Is there a way to do something similar with an application written in java? In the end I want to ...