Skip to main content

Questions tagged [function-hooking]

Correspond to all the techniques used to intercept function calls and to attach a piece of code before or/and after the execution of the function itself.

Filter by
Sorted by
Tagged with
11 votes
3 answers
1k views

What methodology can be used to change code flow atomically during program execution?

I have been reading a lot about the different techniques for Windows API hooking (a technique I'm particularly fascinated by and fond of), and it seems a major problem in implementing a realiable ...
CaptainObvious's user avatar
8 votes
2 answers
7k views

Hooking Java APIs

In native code on windows functions can be hooked by replacing their prologue with a JMP instruction. Is there a way to do something similar with an application written in java? In the end I want to ...
Avery3R's user avatar
  • 1,258
5 votes
2 answers
7k views

How to hook the entry point of a DLL?

I have written a C API with support for static import hooking via overwriting the corresponding IAT entry of an exported function. It works nicely for older simple applications, but for more modern ...
CaptainObvious's user avatar
5 votes
1 answer
2k views

DLL Injection search for procedures/variables

I am learning DLL injection basics and different techniques to achieve it, like using CreateProcess and LoadLibrary for example, or simply replacing a .dll in folder where the application to inject ...
astralmaster's user avatar
5 votes
0 answers
381 views

Static Address in Dynamically Loaded DLL

I am trying to re-write the following function in my injected DLL. mov edi,edi push ebp mov ebp,esp mov eax, [sound.dll+1AE0] push eax mov ecx,[ebp+08] mov eax,[ecx] mov eax,[eax+0C] push eax call ...
fred26's user avatar
  • 319
4 votes
5 answers
24k views

print [B byte array in frida js script

I'm learning frida and trying to hook a function that looks like: `.method public final fn()[B` It returns a byte array. Here's my code: Java.perform(function () { var test = Java.use("com...");...
aj3423's user avatar
  • 209
4 votes
4 answers
7k views

Calculation of jmp address through subtraction

I don't get why the two addresses of the functions are subtracted in order to get the jump destination. mov eax, [ebp+func1] sub eax, [ebp+func2] sub eax, 5 mov [ebp+var_4], eax Which ...
pudi's user avatar
  • 180
4 votes
1 answer
2k views

Hooking function with frida

How can i hook functions with frida? Can someone give me an example please, for something that do that? Hook at 0x412312 and change the assembly code to "mov eax, 999" I Arleady tried something like:...
yoni's user avatar
  • 69
4 votes
1 answer
2k views

Detecting SSDT and inline hooks in kernel

I did a simple SSDT Hooks detector that iterates through all entries and checks if any address is outside the Kernel module. If so, I can even go back and using the syscall find out what function was ...
user3002428's user avatar
4 votes
1 answer
317 views

Where do mouse/keyboard GUI inputs get queued or stored?

Where do mouse-clicks in a program's GUI window/menus (Windows OS) get stored in memory? Is there some sort of input/GUI "queue" similar to Windows messages queuing? I'm wondering if it'd be possible ...
Coldblackice's user avatar
3 votes
3 answers
2k views

Modifying Windows DLLs

I find myself playing in strange territory lately, venturing far outside my comfort zone to test some theories. At present I want to return True every time a specific program calls IsDebuggerPresent, ...
Bjørn Ulfson's user avatar
3 votes
3 answers
1k views

IAT Hook via Kernel Driver

I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver. I want to hook the IAT of another driver from my driver if that makes sense. So I ...
Ballers's user avatar
  • 49
3 votes
2 answers
2k views

Frida reading files is slow

I need to read a file around 2 MB into a byte array. var fis = Java.use("java.io.FileInputStream"); var file = fis.$new("/data/local/file.txt"); var fileBytes = new Uint8Array(file....
Cagri's user avatar
  • 176
3 votes
1 answer
1k views

How do I call a statically imported function from a Dll? call dword ptr ds <> not working

Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call. Now I actually want to do things with a ...
Carraway's user avatar
3 votes
2 answers
1k views

Why hook a function rather than set a breakpoint

I know hooking is usually used as a technique when one would rather use external (or injected) code to manipulate an executable, vs breakpoints which are usually set by a debugging framework in an ...
grepNstepN's user avatar
3 votes
0 answers
131 views

How can I find out which system functions are used in applications using dynamic loading?

I'm trying to make an application that tries to hook a specific function. but I realized something while working, I can't hook functions of applications that use dynamic loading using the detours ...
DertliSelo's user avatar
3 votes
0 answers
249 views

How are single-player games made into multiplayer ones? [closed]

I was always curious about how some single-player games are turned into multiplayer ones. Some samples are SA-MP and MTA, that turn Grand Theft Auto: San Andreas into a multiplayer game. In an ...
Stanley Sathler's user avatar
3 votes
0 answers
673 views

Hooking the BootClassLoader [closed]

According to Wikipedia, there are 3 class loaders. The Boot Class-Loader which loads everything in RT.jar and /../jre/lib Then the extensions class loader and the system class loader. I'm only ...
user11780's user avatar
2 votes
1 answer
515 views

How to hook to a system function

How to hook to external library function, such as OpenGL for example. I have a function used by the program I am trying to change behaviour of. The function is: lVar17 = glfwCreateWindow(uVar22,uVar25,...
Irbis77's user avatar
  • 328
2 votes
3 answers
1k views

Winapi ReadFile monitor

I'm trying to make a small proxy dll that will be able to print out all the files that a game tries to access from disk. I'm using a dinput8 wrapper dll as my proxy dll, from where I've managed to ...
Greg's user avatar
  • 175
2 votes
1 answer
491 views

Hooking IAT in remote process with Python?

I'm trying to hook a win32 function call (CreateFileW) inside of a notepad process to have the function do additional actions before returning what it should do. Ultimately, this will assist me in ...
tunemein's user avatar
2 votes
1 answer
445 views

Hiding a file in a Windows operating system

I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis. What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
turtle's user avatar
  • 21
2 votes
1 answer
1k views

Trying to hook DirectX9 using C++ - Keeps crashing

I posted a thread on StackOverflow a few days ago, and it's got little attention, so i though it's possible this might be a better place for it. As the title says, i'm trying to hook/detour DirectX9 ...
Michael Strobel's user avatar
2 votes
2 answers
338 views

Adding a hook to the end of a function

I have a (so-called) function with multiple entry points but only one ret. I am trying to understand how to add a hook to the function. The main problem I'm facing is the code that is placed right ...
EL_9's user avatar
  • 121
2 votes
1 answer
492 views

How use signature pattern for hooking

I like to replace the static function address: AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer) using signature pattern: SigScan ...
user3449922's user avatar
2 votes
2 answers
5k views

Patching JNZ (two byte opcode) into JMP near (one byte opcode)?

I've been tinkering with Fallout New Vegas, and have focused on modifying a very simple record that's hardcoded in the game engine. It's called an Imagespace Modifier, which is a very basic shader ...
FiftyTifty's user avatar
2 votes
1 answer
1k views

Hooking function with C++, IDA and .pdb file

I want to call a function in a program. I do this from a DLL entry point. I opened the program in IDA together with its .pdb file. This is what the function looks like according to IDA: void ...
TheElderScroller's user avatar
2 votes
1 answer
352 views

Hooking in Immunity - LogBpHook not working

I try to use a simple hook on different memory allocation functions in Immunity. But the hook doesn't react at all (no logging). First of all my hook class: class AllocHook(LogBpHook): def ...
knx's user avatar
  • 1,257
2 votes
1 answer
120 views

What is an easy way to update the addresses of hooked functions in an exe

I have hooked into some functions in an exe. I was wondering if there were any simple ways to detect the memory addresses of these functions after the exe has a new build (not my exe). Is the best way ...
pokerguy's user avatar
2 votes
0 answers
197 views

How can I detect which Android native function that is hooked by Mobile Substrate: MSHookFunction?

I want to detect hook behavior of MSHookFunction on Android. This is Mobile Substrate I use in my test app https://github.com/Breathleas/Android-Hooking-Template-Cydia-Substrate/tree/master/jni/...
Ken Kem's user avatar
  • 121
2 votes
0 answers
155 views

statically placing hooks on PE file's IAT

recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully ...
VEIL's user avatar
  • 21
2 votes
0 answers
53 views

Redirect exception handler?

I'm working on a localization project and have a few trampoline hooks to translate some text in an online game. Periodically throughout gameplay, there are checks that run in the background to ensure ...
isuckatreversing's user avatar
2 votes
0 answers
1k views

How can I enumerate and hook all non-exported functions in lib.so using frida?

I was reverse engineering an apk and just found out it is using native functions for such operations. there are some exported and non-exported functions. wanted to get and hook those non-exported ...
hanan's user avatar
  • 309
2 votes
0 answers
120 views

Cant hook into native lib with script?

im doing some practice stuff about hooking android native lib. I wrote this script: function processJniOnLoad(libraryName) { const funcSym = "...
Brian MJ's user avatar
2 votes
0 answers
9k views

How to step to specific function call?

I'm reverse engineering an application and I identified a specific function call that has an output that I need to capture. For the actual capture, I'll do a memory dump, so that I can handle. However,...
Axel Munoz's user avatar
2 votes
0 answers
1k views

frida hook jni not work

I want to trace Android Telegram app(open-source) to learn its protocol. From the source code these two functions AES_set_encrypt_key and AES_ctr128_encrypt are used to do the encryption, and I can ...
aj3423's user avatar
  • 209
2 votes
1 answer
2k views

How to override c++ string class with LD_PRELOAD

i am trying to override predefined functions such as strcmp, getenv, etc. i already override some of them using LD_PRELOAD options. but i can't override string class, how can i override c++ string ...
Mustafa Akdeniz's user avatar
2 votes
0 answers
497 views

Calling original function that uses unconventional calling convention

I'm using MinHook to hook a static function with the following signature: float __usercall RadarManager::Add_Blip@<xmm0>(int position@<ecx>, int shape@<edx>, int colorId, float ...
Neijwiert's user avatar
  • 133
2 votes
0 answers
423 views

What encryption/compression is this, and how to encode/decode from it?

I've been trying to reverse engineer an Android app's communication protocol using a combination of Xposed and Packet sniffing. Most of the packets the app sends have this header set: Content-Type: ...
dylanpdx's user avatar
1 vote
2 answers
10k views

How to add code to compiled java class

I have java code that is compiled to a .class file. There is a function that gets few parameters and do some action (e.g. get int x and int y and do x+y) I want to add to this .class file code that ...
Hook's user avatar
  • 31
1 vote
1 answer
319 views

Hook naked function with CPU registers

I need to hook this function: .text:005589CB sub_5589CB proc near ; CODE XREF: AddHealth(int,long)+1A↑j .text:005589CB ; sub_5328D8+98E↑p ... ...
user3449922's user avatar
1 vote
2 answers
1k views

hooking sleep & beep syscalls

I have a binary which is playing a Morse code using calls to Beep & Sleep. This file is Windows PE32 exe which I open via Wine on my Ubuntu (16.04). How can I extract the arguments which passed ...
whoopdedoo's user avatar
1 vote
1 answer
744 views

Can this method be hooked in iOS?

Here's IDA: http://pastebin.com/AkU0MDWh Also, would this be written in C to show like this? In comparison to a regular method like: ListRowCell - (id)initWithStyle:(int) reuseIdentifier:(id)
abuhun's user avatar
  • 11
1 vote
2 answers
260 views

Using IAT Hooking to hook end of function

Is it possible? Maybe you can explain it with a simple example if that's possible?
Michael's user avatar
  • 11
1 vote
2 answers
471 views

learning detour and code injection

i am looking to expand my knowledge so i can someday(hopefully within few months) be able to join the reverse engineering community, probably in the anti-virus/defense field. i was wondering, since ...
newB's user avatar
  • 19
1 vote
1 answer
143 views

Why does vmt hooking not work with instance member in the following case?

Why does the function not get hooked when called with instance member obj.myFunc() ? class Myclass { public: virtual void myFunc() = 0; }; class Derived : public Myclass { public: void ...
kk ll's user avatar
  • 13
1 vote
2 answers
294 views

MSDetour not detouring SHGetKnownFolderPath

Tried to hook SHGetKnownFolderPath from shell32, using the normal DetourFunctionWithTrampoline, and it could not. Investigating, it seen that the application use GetProcAddress to load the function, ...
Shmuel Fomberg's user avatar
1 vote
1 answer
240 views

How would I go about getting an application's XMPP request before it is SSL-encrypted?

Disclaimer: I am very new to Reverse Engineering, though it captivates me. Hence, I'm apologizing beforehand if I say anything ridiculous in the following, and hope you will help me find the way! ...
Azami's user avatar
  • 111
1 vote
1 answer
330 views

Using struct objects and constructors in hooked function

Will try to reword the actual question so it is hopefully more descriptive and clear of what I am after: So, there is a function main, which I have successfully hooked. The hooked version looks like ...
Irbis77's user avatar
  • 328
1 vote
1 answer
157 views

Inconsistency in function addresses of the hooked functions (address shift)

I came across "a strange" inconsistency in terms of the function addresses in the particular application. First, the main function is hooked successfully, the address is derived in a fashion:...
Irbis77's user avatar
  • 328