Questions tagged [hooking]
The hooking tag has no usage guidance.
12
questions
1
vote
0answers
42 views
what are modern hooking techniques? [closed]
i was looking at interesting anti malware roles (malware analysis and prevention) and among the required skills they mentioned that "modern hooking techniques" should be well acquainted with. i was ...
1
vote
1answer
98 views
Hiding a file in a Windows operating system
I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis.
What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
1
vote
0answers
72 views
How to hook eval function in node.js
As the eval() function of JavaScript is an evil, I want to hook or monkey-patch eval() function of JavaScript in node.js. I want to intercept all arguments passed in eval() function. Please guide me ...
1
vote
1answer
338 views
Hooking function with frida
How can i hook functions with frida?
Can someone give me an example please, for something that do that?
Hook at 0x412312 and change the assembly code to "mov eax, 999"
I Arleady tried something like:...
-1
votes
1answer
243 views
Intercept zip decryption key or files from an application
If an application is reading from a password protected zip file, is there a way to intercept the key being sent to decrypt the zip file. Or, is there a way to dump the files being read themselves?
0
votes
0answers
31 views
javascript hook comparisons
Look at this very basic javascript code:
if (s=='abcd')
{
if (s2='cdef')
{
...
}
}
I want to hook all tests: I want to get this:
(s,'==','abcd')
(s2,'==','cdef')
Is there a way ...
1
vote
1answer
101 views
Why does vmt hooking not work with instance member in the following case?
Why does the function not get hooked when called with instance member obj.myFunc() ?
class Myclass
{
public:
virtual void myFunc() = 0;
};
class Derived : public Myclass
{
public:
void ...
0
votes
2answers
706 views
What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?
There are gazillions of internet resources discussing how to use Frida to hook and otherwise mess around with SSL connections of Java programs running under Android, but seemingly (as far as my google-...
2
votes
2answers
117 views
Check if instruction is reached
I am doing a challenge for a CTF and I have to reverse an encryption scheme to find a flag. However it would be easier to just try all inputs but they are too much.
There is an instruction that when ...
1
vote
1answer
65 views
Windbg Break Points
I need to set a break point when a specific module address space is being overwritten? I need to specify this by module name not address space
2
votes
1answer
209 views
How to see ReadFile results with ProcMon
I running procmon to monitor my process, and see that my process uses ReadFile API.
How can I see which data the process received when it uses ReadFile?
3
votes
1answer
920 views
Is it possible to hook CPU instructions without severe performance impact?
I have been working on some unpackers, and I noticed that at their end, they mostly use this:
mov edx, [ebp+oep]
call edx ; now, you're at the OEP of the original binary
Or this:
mov ecx, [ebp+oep]
...
