7 votes
Accepted

print [B byte array in frida js script

var ret = this.fn(); var buffer = Java.array('byte', ret); console.log(buffer.length); var result = ""; for(var i = 0; i < buffer.length; ++i){ result+= (String.fromCharCode(buffer[i])); } ...
user avatar
7 votes
Accepted

Calculation of jmp address through subtraction

I'll start with briefly going over the code for completeness's sake even though OP clearly understands what's going on and mostly asks about the reasoning behind it. The first snippet of code can be ...
user avatar
  • 11.3k
6 votes

Hooking Java APIs

edit: This question overlaps with Dynamic java instrumentation? Jeong Wook Oh did a presentation at Blackhat 2012 were he explained how to trace Java programs by modifying the bytecode to call hook ...
user avatar
  • 2,158
6 votes
Accepted

DLL Injection search for procedures/variables

If you want to use a function in the application the bottom line is that you need to know where it's located. Without ASLR you can hardcode the address of the function into your DLL, and use a ...
user avatar
  • 211
4 votes

What methodology can be used to change code flow atomically during program execution?

A sketch of how to implement your own patching system, where the length of the replacement instruction is less than or equal to the length of the instruction that you want to patch: Make sure that ...
user avatar
4 votes
Accepted

How to hook the entry point of a DLL?

To answer the original question, what you can do is to hook LdrpCallInitRoutine in ntdll.dll. This function is used by DLL loading/unloading code to actually call the DLL entry point (DllMain) and ...
user avatar
  • 34.6k
4 votes
Accepted

Inline assembly does not compile

Yes 01311723 is a constant and compiler will not know what it is Neither would compiler know what jmpBackAddy is for constant you need to replace it with a label and define the label for a ...
user avatar
  • 14.8k
4 votes

Hooking function with frida

Try using Memory.patchCode to achieve this. Here's a short example. int test() { return 1024; } int main(int argc, char **argv) { printf("%d\n", test()); return 0; } When compiled this ...
user avatar
  • 2,345
4 votes
Accepted

How to hook to a system function

Two possibilities: Patch the call instruction to point to a destination of your choosing, such as a "code cave" between the end of the .text section and the subsequent section. Write your ...
user avatar
  • 7,814
3 votes
Accepted

Calling a function of a game inside a function hook

The problem is that the game's functions are usually expected to be called only in certain circumstances. If you're calling a function at a time when it's not prepared for it, the game's state may be ...
user avatar
  • 34.6k
3 votes
Accepted

Modifying Windows DLLs

Windows has a concept of trusted libraries to hamper attacks like these: Dynamic-Link Library Search Order Citing from the search order: If the DLL is on the list of known DLLs for the version of ...
user avatar
  • 2,806
3 votes

Winapi ReadFile monitor

Why not use existing tools to do the job? If you're just trying to monitor which files get accessed I would suggest to use Process Monitor: Process Monitor is an advanced monitoring tool for Windows ...
user avatar
  • 2,908
3 votes

Can this method be hooked in iOS?

You can hook this method (and most other methods) in iOS if codesigning enforcement is turned off in the kernel, e.g. on a jailbroken iOS device. The way to do this is to overwrite the first few ...
user avatar
3 votes

How to hook the entry point of a DLL?

You should not be using IAT overwriting hooking method for the same reasons you mentioned. Use the inline hooking method with a JMP instruction to the target hook. You need to save the overwritten ...
user avatar
  • 5,850
3 votes

Detecting SSDT and inline hooks in kernel

If your looking for SSDT hooking with WinDbg, have tried the SwishDbgExt.dll? Here is the link to the author's page - http://www.msuiche.net/2014/07/16/thats-so-swish Update: http://www.msuiche.net/...
user avatar
  • 61
3 votes

Calling a function of a game inside a function hook

In addition to Igor's answer I would like to suggest an alternative approach: If the function you're trying to call indeed expects some additional preparations, specific conditions for global game ...
user avatar
  • 11.3k
3 votes

How to add code to compiled java class

There are several ways to achieve this: Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
user avatar
  • 34.6k
3 votes

print [B byte array in frida js script

Frida's java byte array element representation is signed number currently. Therefore, your byte array may contain negative number. We should edit accepted answer to reflect this: var buffer = Java....
user avatar
  • 131
3 votes
Accepted

Reversing: DeviceIoControl return value

Why would you want to reverse engineer a well-documented function? The underlying mechanism, IOCTLs, are explained as part of the documentation for device drivers. Even the native function underlying ...
user avatar
  • 10.5k
3 votes

Calculation of jmp address through subtraction

E9 is a relative jump and since it was supposed to be inserted at the beginning of the function then sub-tracting the two addresses is the way to go for calculating the difference in bytes. Why ...
user avatar
3 votes
Accepted

Hook naked function with CPU registers

There is no instruction for pushing xmm registers, but you can do as follow: __asm { sub esp, 16 movdqu [esp], xmm0 sub esp, 16 movdqu [esp], xmm1 pushad } ...
user avatar
3 votes
Accepted

Hooking IAT in remote process with Python?

I cross-posted this to another community that I'm a part of and ended up getting my answer (I should have done this sooner..): It was likely that my code was getting garbage collected, hence the lock ...
user avatar
2 votes

What methodology can be used to change code flow atomically during program execution?

Here's an older article on how hotpatching was implemented in Windows. If you want it done absolutely atomically, it has to be done from the kernel mode. There's no way around it. Here's the ...
user avatar
  • 1,275
2 votes

What methodology can be used to change code flow atomically during program execution?

This is a good question, and I would argue there is no 100% safe method to patch a running windows process, unless you actively debug it, and even then there are probably edge cases. You could ...
user avatar
2 votes

How would I go about getting an application's XMPP request before it is SSL-encrypted?

Thanks for providing a good amount of context in your question. Yes, hooking is the way to go. The function that you'd want to hook is the function that performs the SSL encryption, as it would be ...
user avatar
2 votes

MSDetour not detouring SHGetKnownFolderPath

DetourFunction() is from an older version of Detours. Probably best to upgrade to the latest version of the library. (The equivalent function is now DetourAttach().) If you're using DetourFunction(...
user avatar
2 votes

Instrumenting syscall by static binary rewriting

PIN_AddSyscallEntryFunction and PIN_AddSyscallExitFunction should do the trick. Link to the Documentation. Snippet using theses APIs : (credits to Jurriaan Bremer) #include <stdio.h> #include "...
user avatar
  • 578
2 votes
Accepted

Help with anti-disassembly trick inside a hooked function

There is no obfuscation here, it is a fairly standard jump to a fixed address. Breaking it down: FF 25 00 00 00 00 ; jmp qword ptr [rip] 68 01 4A 00 00 00 00 00 ; dq 00000004A0168h The ...
user avatar
2 votes

How to add code to compiled java class

You can use JByteMod to edit your class bytecode. You can also create new methods, delete methods, fields and change accesses. Its pretty easy to use, just load the jar and select the class you want ...
user avatar
  • 141
2 votes

hooking sleep & beep syscalls

not sure what you mean dot will always sound like dot wont it ? so logically it will always have the same frequency and same duration ? like wise dash will always sound like dash ? if it varied ...
user avatar
  • 14.8k

Only top scored, non community-wiki answers of a minimum length are eligible