Skip to main content
10 votes
Accepted

print [B byte array in frida js script

var ret = this.fn(); var buffer = Java.array('byte', ret); console.log(buffer.length); var result = ""; for(var i = 0; i < buffer.length; ++i){ result+= (String.fromCharCode(buffer[i])); } ...
user23797's user avatar
  • 116
7 votes
Accepted

Calculation of jmp address through subtraction

I'll start with briefly going over the code for completeness's sake even though OP clearly understands what's going on and mostly asks about the reasoning behind it. The first snippet of code can be ...
NirIzr's user avatar
  • 11.8k
6 votes

Hooking function with frida

Try using Memory.patchCode to achieve this. Here's a short example. int test() { return 1024; } int main(int argc, char **argv) { printf("%d\n", test()); return 0; } When compiled ...
sudhackar's user avatar
  • 2,709
5 votes
Accepted

Modifying Windows DLLs

Windows has a concept of trusted libraries to hamper attacks like these: Dynamic-Link Library Search Order Citing from the search order: If the DLL is on the list of known DLLs for the version of ...
Nordwald's user avatar
  • 2,906
4 votes
Accepted

Inline assembly does not compile

Yes 01311723 is a constant and compiler will not know what it is Neither would compiler know what jmpBackAddy is for constant you need to replace it with a label and define the label for a ...
blabb's user avatar
  • 16.4k
4 votes

print [B byte array in frida js script

Frida's java byte array element representation is signed number currently. Therefore, your byte array may contain negative number. We should edit accepted answer to reflect this: var buffer = Java....
rosshjb's user avatar
  • 141
4 votes
Accepted

How to hook to a system function

Two possibilities: Patch the call instruction to point to a destination of your choosing, such as a "code cave" between the end of the .text section and the subsequent section. Write your ...
Rolf Rolles's user avatar
  • 9,198
3 votes

How to add code to compiled java class

There are several ways to achieve this: Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Calling a function of a game inside a function hook

In addition to Igor's answer I would like to suggest an alternative approach: If the function you're trying to call indeed expects some additional preparations, specific conditions for global game ...
NirIzr's user avatar
  • 11.8k
3 votes
Accepted

Calling a function of a game inside a function hook

The problem is that the game's functions are usually expected to be called only in certain circumstances. If you're calling a function at a time when it's not prepared for it, the game's state may be ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

Winapi ReadFile monitor

Why not use existing tools to do the job? If you're just trying to monitor which files get accessed I would suggest to use Process Monitor: Process Monitor is an advanced monitoring tool for Windows ...
Remko's user avatar
  • 3,283
3 votes

Can this method be hooked in iOS?

You can hook this method (and most other methods) in iOS if codesigning enforcement is turned off in the kernel, e.g. on a jailbroken iOS device. The way to do this is to overwrite the first few ...
planetbeing's user avatar
3 votes
Accepted

Reversing: DeviceIoControl return value

Why would you want to reverse engineer a well-documented function? The underlying mechanism, IOCTLs, are explained as part of the documentation for device drivers. Even the native function underlying ...
0xC0000022L's user avatar
  • 10.9k
3 votes

Calculation of jmp address through subtraction

E9 is a relative jump and since it was supposed to be inserted at the beginning of the function then sub-tracting the two addresses is the way to go for calculating the difference in bytes. Why ...
Paweł Łukasik's user avatar
3 votes
Accepted

Hook naked function with CPU registers

There is no instruction for pushing xmm registers, but you can do as follow: __asm { sub esp, 16 movdqu [esp], xmm0 sub esp, 16 movdqu [esp], xmm1 pushad } ...
macro_controller's user avatar
3 votes
Accepted

Hooking IAT in remote process with Python?

I cross-posted this to another community that I'm a part of and ended up getting my answer (I should have done this sooner..): It was likely that my code was getting garbage collected, hence the lock ...
tunemein's user avatar
2 votes

MSDetour not detouring SHGetKnownFolderPath

DetourFunction() is from an older version of Detours. Probably best to upgrade to the latest version of the library. (The equivalent function is now DetourAttach().) If you're using DetourFunction(...
Jason Geffner's user avatar
2 votes

How would I go about getting an application's XMPP request before it is SSL-encrypted?

Thanks for providing a good amount of context in your question. Yes, hooking is the way to go. The function that you'd want to hook is the function that performs the SSL encryption, as it would be ...
Jason Geffner's user avatar
2 votes
Accepted

How do I call a statically imported function from a Dll? call dword ptr ds <> not working

It appears you've already guessed what the actual issue is - your call instruction is using direct addressing and not relative addressing. This means that when a DLL changes it's location between ...
NirIzr's user avatar
  • 11.8k
2 votes

hooking sleep & beep syscalls

not sure what you mean dot will always sound like dot wont it ? so logically it will always have the same frequency and same duration ? like wise dash will always sound like dash ? if it varied ...
blabb's user avatar
  • 16.4k
2 votes

How to add code to compiled java class

You can use JByteMod to edit your class bytecode. You can also create new methods, delete methods, fields and change accesses. Its pretty easy to use, just load the jar and select the class you want ...
Princekin's user avatar
  • 141
2 votes
Accepted

Help with anti-disassembly trick inside a hooked function

There is no obfuscation here, it is a fairly standard jump to a fixed address. Breaking it down: FF 25 00 00 00 00 ; jmp qword ptr [rip] 68 01 4A 00 00 00 00 00 ; dq 00000004A0168h The ...
josh poley's user avatar
2 votes

What methodology can be used to change code flow atomically during program execution?

Here's an older article on how hotpatching was implemented in Windows. If you want it done absolutely atomically, it has to be done from the kernel mode. There's no way around it. Here's the ...
c00000fd's user avatar
  • 1,711
2 votes

print [B byte array in frida js script

One liner console.log(Java.use("java.util.Arrays").toString(ret));
AMRTS's user avatar
  • 21
2 votes
Accepted

Trying to hook DirectX9 using C++ - Keeps crashing

I figured it out, reversed the binary in IDA, found the module address and the EndScene function aswell as its address, calculated the offset. Then used ollydbg and found the function again, made a ...
Michael Strobel's user avatar
2 votes

Calculation of jmp address through subtraction

I don't have access to the book so let's say func1 starts at address 0x10 and func2 starts at 0x30. The distance between func2 and func1 is therefore 0x20 bytes. If you want to jump from the ...
zxxc's user avatar
  • 233
2 votes
Accepted

Why does vmt hooking not work with instance member in the following case?

The problem is the way you reference this object with a new pointer. Derived obj = *ptr; This actually creates a new object utilizing the data of the old object. Yay! C++! In line 27 you can see ...
Nordwald's user avatar
  • 2,906
2 votes

Hiding a file in a Windows operating system

There are ways to do it without resorting to hooking or drivers. For example alternate data streams (ADS), or creating files with "illegal", i.e. reserved, names (NUL, CON ... trailing ., alternative ...
0xC0000022L's user avatar
  • 10.9k
2 votes

Frida reading files is slow

The reason why your code is slow is not Frida but your code. Your code would be also slow when executed in plain J2SE Java. The simple reason is because you are reading the file byte by byte using an ...
Robert's user avatar
  • 1,097
2 votes

IAT Hook via Kernel Driver

The problem seems to be in the source address calculation: &ImportDescriptor.Name + (uintptr_t)ModuleBase This adds the address of a local variable (which is on the stack) to the image base, so ...
Igor Skochinsky's user avatar
  • 36.8k

Only top scored, non community-wiki answers of a minimum length are eligible