Skip to main content

Questions tagged [hooking]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
2 answers
61 views

How does Rohitab ApiMonitor capture API calls?

When I use EasyHook to hook API calls, the first bytes of the hooked API function are replaced with a so called "trampoline" which is a jump into EasyHook code. For example this is TextOutW ...
Elmue's user avatar
  • 461
0 votes
1 answer
127 views

Hooking a function

So, I'm attempting to create a mod for an older game, Fable: The Lost Chapters. I was able to find the MacOS release of the game, which contains symbols, and I was also able to find a leaked debug ...
Reaper's user avatar
  • 1
1 vote
1 answer
89 views

Unable to run system Save As dialogue while debugging Notepad with IDA

I am trying to hook a function to Notepad.exe, so that it will encrypt a file when saving. I have dis-assembled it with IDA. I want to place breakpoints on the saving subroutine which I have ...
Yizhar Amir's user avatar
3 votes
0 answers
202 views

Solved: Unable to hook Apple binary on iOS 14.x with Frida

I'm attempting to analyze a binary from iOS 14.8 (searchpartyd). I'm using Frida to try to hook it like I normally would with other binaries. However, I'm getting an error message that I'm unable to ...
AGreen BHM's user avatar
1 vote
0 answers
166 views

problem with hooking __usercall function and asm code

I need a hook function with the __usercall convention. I already hooked functions that were defined as __usercall and __userpurge, but this time it's __usercall with arguments that are also passed ...
user42122's user avatar
1 vote
1 answer
634 views

Create instance of iOS class that contains a . with frida

I am trying to create an instance of a class of an iOS app using Frida. In the past I have successfully done this using a command such as: var instance = ObjC.chooseSync(ObjC.classes.TestClass)[0]; ...
Jon's user avatar
  • 177
1 vote
0 answers
109 views

Instruction-level hooking library for win32?

I am looking for instruction-level hooking library for win32 x86/x64. I want to write hook insertion and hook implementation code in C/C++ (compiled into dll). (Therefore instrumentation tools are ...
user2771324's user avatar
1 vote
0 answers
172 views

Easy way to attach a DLL to a Game

I like to attach a dll to a game to add more features. The DLL is 95% done, the problem is find the best and easy way to load this dll from the Game. My idea is use this technique: dinput_ori.dll (...
user3449922's user avatar
0 votes
0 answers
226 views

Crash after hook a function

I have hooked a sound function that work within the game menu after, when the battle start, the game will crash. The function at the first parameter get correctly the sound file name, before the ...
user3449922's user avatar
1 vote
1 answer
530 views

frida - The specified child already has a parent. You must call removeView() on the child's parent first when hooking, how do you solve it?

I wanted to hook the method A1f in the below code but frida returns the following exceptions: Found instance: MyHomeFragment{9bbd8d5} (0965bca9-4838-4ca1-a835-d99639ae15f1)} java.lang....
hanan's user avatar
  • 309
1 vote
0 answers
140 views

what are modern hooking techniques? [closed]

i was looking at interesting anti malware roles (malware analysis and prevention) and among the required skills they mentioned that "modern hooking techniques" should be well acquainted with. i was ...
beginner's user avatar
2 votes
1 answer
445 views

Hiding a file in a Windows operating system

I am trying to understand how to hide a file in windows as a way to learn about win api and malware analysis. What I am trying to do is to make a file "disappear" via some kind of manipulation. But I ...
turtle's user avatar
  • 21
1 vote
0 answers
280 views

How to hook eval function in node.js

As the eval() function of JavaScript is an evil, I want to hook or monkey-patch eval() function of JavaScript in node.js. I want to intercept all arguments passed in eval() function. Please guide me ...
sumit_suthar's user avatar
4 votes
1 answer
2k views

Hooking function with frida

How can i hook functions with frida? Can someone give me an example please, for something that do that? Hook at 0x412312 and change the assembly code to "mov eax, 999" I Arleady tried something like:...
yoni's user avatar
  • 69
0 votes
1 answer
772 views

Intercept zip decryption key or files from an application

If an application is reading from a password protected zip file, is there a way to intercept the key being sent to decrypt the zip file. Or, is there a way to dump the files being read themselves?
thisisnice05's user avatar
0 votes
0 answers
78 views

javascript hook comparisons

Look at this very basic javascript code: if (s=='abcd') { if (s2='cdef') { ... } } I want to hook all tests: I want to get this: (s,'==','abcd') (s2,'==','cdef') Is there a way ...
Bob5421's user avatar
  • 797
1 vote
1 answer
143 views

Why does vmt hooking not work with instance member in the following case?

Why does the function not get hooked when called with instance member obj.myFunc() ? class Myclass { public: virtual void myFunc() = 0; }; class Derived : public Myclass { public: void ...
kk ll's user avatar
  • 13
1 vote
2 answers
2k views

What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?

There are gazillions of internet resources discussing how to use Frida to hook and otherwise mess around with SSL connections of Java programs running under Android, but seemingly (as far as my google-...
QuestionOverflow's user avatar
2 votes
2 answers
262 views

Check if instruction is reached

I am doing a challenge for a CTF and I have to reverse an encryption scheme to find a flag. However it would be easier to just try all inputs but they are too much. There is an instruction that when ...
letFunny's user avatar
1 vote
1 answer
95 views

Windbg Break Points

I need to set a break point when a specific module address space is being overwritten? I need to specify this by module name not address space
user26171's user avatar
2 votes
1 answer
799 views

How to see ReadFile results with ProcMon

I running procmon to monitor my process, and see that my process uses ReadFile API. How can I see which data the process received when it uses ReadFile?
pointers's user avatar
3 votes
1 answer
2k views

Is it possible to hook CPU instructions without severe performance impact?

I have been working on some unpackers, and I noticed that at their end, they mostly use this: mov edx, [ebp+oep] call edx ; now, you're at the OEP of the original binary Or this: mov ecx, [ebp+oep] ...
user avatar