6

If you want to use a function in the application the bottom line is that you need to know where it's located. Without ASLR you can hardcode the address of the function into your DLL, and use a function pointer to call it. If you want to modify data from a function in a loaded library then you would need to hook that function, and call your own code for its ...


6

edit: This question overlaps with Dynamic java instrumentation? Jeong Wook Oh did a presentation at Blackhat 2012 were he explained how to trace Java programs by modifying the bytecode to call hook methods, see the "Automation" section of the paper. There is no source or tool available as far as I know. Paper Video There is also a tool called Javasnoop ...


6

I'll start with briefly going over the code for completeness's sake even though OP clearly understands what's going on and mostly asks about the reasoning behind it. The first snippet of code can be easily written like the following in C: dword var_4 = &func1 - &func2 - 5; This piece of code, by itself, raises a few questions we'll answer in a bit ...


4

Windows has a concept of trusted libraries to hamper attacks like these: Dynamic-Link Library Search Order Citing from the search order: If the DLL is on the list of known DLLs for the version of Windows on which the application is running, the system uses its copy of the known DLL (and the known DLL's dependent DLLs, if any) instead of searching for ...


4

To answer the original question, what you can do is to hook LdrpCallInitRoutine in ntdll.dll. This function is used by DLL loading/unloading code to actually call the DLL entry point (DllMain) and also the TLS callbacks. The first argument is the address to be called: BOOLEAN NTAPI LdrpCallInitRoutine(PDLL_INIT_ROUTINE EntryPoint, PVOID BaseAddress, ULONG ...


3

Yes 01311723 is a constant and compiler will not know what it is Neither would compiler know what jmpBackAddy is for constant you need to replace it with a label and define the label for a label you need to define it in the asm src code #include <windows.h> #pragma comment(lib ,"user32.lib") #pragma comment(lib ,"kernel32.lib") int CALLBACK ...


3

You can hook this method (and most other methods) in iOS if codesigning enforcement is turned off in the kernel, e.g. on a jailbroken iOS device. The way to do this is to overwrite the first few instructions of the function with some instructions to jump to your hook. Your hook then call back to some instructions elsewhere that performs the instructions you ...


3

A sketch of how to implement your own patching system, where the length of the replacement instruction is less than or equal to the length of the instruction that you want to patch: Make sure that none of your code depends on any of the code that you will want to patch. This is an issue of re-entrancy. If you patch code that your patching system will use, ...


3

You should not be using IAT overwriting hooking method for the same reasons you mentioned. Use the inline hooking method with a JMP instruction to the target hook. You need to save the overwritten bytes somewhere as you need to use it as the trampoline. See this as an example of inline hook. Using inline hook ensures that all (existing or future) modules ...


3

The problem is that the game's functions are usually expected to be called only in certain circumstances. If you're calling a function at a time when it's not prepared for it, the game's state may be wrong and you may get crashes or other unexpected behavior. For example, in normal code flow the caller prepares some objects before calling the function, but ...


3

In addition to Igor's answer I would like to suggest an alternative approach: If the function you're trying to call indeed expects some additional preparations, specific conditions for global game state variables, etc. It might be easier for you to just reverse engineer the function you're trying to call and implement the modification and state changes you ...


3

var ret = this.fn(); var buffer = Java.array('byte', ret); console.log(buffer.length); var result = ""; for(var i = 0; i < buffer.length; ++i){ result+= (String.fromCharCode(buffer[i])); } console.log(result);


3

Why would you want to reverse engineer a well-documented function? The underlying mechanism, IOCTLs, are explained as part of the documentation for device drivers. Even the native function underlying the Win32 function DeviceIoControl is documented. To find out what a particular IOCTL code means (the 224CDCh in your case), use one of the following methods: ...


3

E9 is a relative jump and since it was supposed to be inserted at the beginning of the function then sub-tracting the two addresses is the way to go for calculating the difference in bytes. Why relative jump instead of an absolute? It's shorter so if one needs to remember the original bytes it's just 3 instead of 5 bytes.


2

If your looking for SSDT hooking with WinDbg, have tried the SwishDbgExt.dll? Here is the link to the author's page - http://www.msuiche.net/2014/07/16/thats-so-swish Update: http://www.msuiche.net/2014/08/19/swishdbgext-update-0-6-20140817/


2

Here's an older article on how hotpatching was implemented in Windows. If you want it done absolutely atomically, it has to be done from the kernel mode. There's no way around it. Here's the walkthrough: Set your thread's IRQL to CLOCK1_LEVEL (heck, you can even try HIGH_LEVEL), which is way above 2, that will pretty much stop all task switching in that ...


2

This is a good question, and I would argue there is no 100% safe method to patch a running windows process, unless you actively debug it, and even then there are probably edge cases. You could eliminate many potential problems, but I feel that potential threading problems couldn't be entirely eliminated for generic purposes. This leaves a couple practical ...


2

Thanks for providing a good amount of context in your question. Yes, hooking is the way to go. The function that you'd want to hook is the function that performs the SSL encryption, as it would be the function that receives the plaintext as input. The hard part is finding that encryption function. To do so, I recommend that you use Process Monitor to ...


2

DetourFunction() is from an older version of Detours. Probably best to upgrade to the latest version of the library. (The equivalent function is now DetourAttach().) If you're using DetourFunction(SHGetKnownFolderPath, Hook), the value for the first parameter is probably pointing to a compiler-created stub for the real SHGetKnownFolderPath() function. ...


2

PIN_AddSyscallEntryFunction and PIN_AddSyscallExitFunction should do the trick. Link to the Documentation. Snippet using theses APIs : (credits to Jurriaan Bremer) #include <stdio.h> #include "pin.H" void syscall_entry(THREADID thread_id, CONTEXT *ctx, SYSCALL_STANDARD std, void *v) { printf("system-call: %d, arguments:", ...


2

Why not use existing tools to do the job? If you're just trying to monitor which files get accessed I would suggest to use Process Monitor: Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. If you want to see what data is being read or written I would suggest Rohitab API ...


2

There is no obfuscation here, it is a fairly standard jump to a fixed address. Breaking it down: FF 25 00 00 00 00 ; jmp qword ptr [rip] 68 01 4A 00 00 00 00 00 ; dq 00000004A0168h The first instruction says to read the value at RIP and then jump to that address. Since RIP is already advanced past the end of the instruction, the data value is ...


2

not sure what you mean dot will always sound like dot wont it ? so logically it will always have the same frequency and same duration ? like wise dash will always sound like dash ? if it varied like monkeydash , goatdash , pigdash each time it sounded then it wont be morse code .... so logically dash will have the same frequency and duration so ...


2

Frida's java byte array element representation is signed number currently. Therefore, your byte array may contain negative number. We should edit accepted answer to reflect this: var buffer = Java.array('byte', ret); var result = ""; for(var i = 0; i < buffer.length; ++i){ result += (String.fromCharCode(buffer[i] & 0xff)); // here!! } console.log(...


2

I figured it out, reversed the binary in IDA, found the module address and the EndScene function aswell as its address, calculated the offset. Then used ollydbg and found the function again, made a signature from it, now i can find it dynamically using a signature scanning function. So i can get the function address with this signature. DWORD dwEndScene = ...


2

I don't have access to the book so let's say func1 starts at address 0x10 and func2 starts at 0x30. The distance between func2 and func1 is therefore 0x20 bytes. If you want to jump from the beginning of func1 to func2 you have two options (using pseudo assembly): using relative jump (opcode E9): 0x10 JR +0x20 ; will jump to 0x10 + func2-func1 = 0x10 + ...


2

The problem is the way you reference this object with a new pointer. Derived obj = *ptr; This actually creates a new object utilizing the data of the old object. Yay! C++! In line 27 you can see that a new object is generated by calling a constructor. If you have a look at the disassembly, you'll see the vtable is not used for the function call. Hence you ...


1

Here are several possible solutions for the problem. Generally specking you will need a combination of watchdog and hidden traps. This will not be a bullet proof but will be good enough to make it hard on the attacker to hook your game. Vary Basic: buy commercial protector for the game Basic: Do not use IAT but resolve everything dynamically. Create ...


1

The address you get is the function definition from the compiler's point of view. It seems you're dealing with an executable compiled with incremental linking enabled (default in Debug builds). When incremental linking is on, the linker generates jump stubs for all functions and refers to them instead of "real" function bodies; this allows it to replace just ...


1

the second column appears to be the length of the string in the third column from whatever was pasted as sample the file so.txt contains the posted sample data :\>awk "{ printf( \"%x \" , length($3)) ;print $2}" so.txt 15 15 15 15 50 50 50 50 3e 3e 4e 4e 48 48 4a 4a 62 62 42 42 4c 4c 44 44 58 58 60 60 :\>


Only top voted, non community-wiki answers of a minimum length are eligible