10
votes
Accepted
print [B byte array in frida js script
var ret = this.fn();
var buffer = Java.array('byte', ret);
console.log(buffer.length);
var result = "";
for(var i = 0; i < buffer.length; ++i){
result+= (String.fromCharCode(buffer[i]));
}
...
- 116
7
votes
Accepted
Calculation of jmp address through subtraction
I'll start with briefly going over the code for completeness's sake even though OP clearly understands what's going on and mostly asks about the reasoning behind it.
The first snippet of code can be ...
- 11.7k
5
votes
Accepted
Modifying Windows DLLs
Windows has a concept of trusted libraries to hamper attacks like these:
Dynamic-Link Library Search Order
Citing from the search order:
If the DLL is on the list of known DLLs for the version of ...
- 2,896
5
votes
Hooking function with frida
Try using Memory.patchCode to achieve this. Here's a short example.
int test() { return 1024; }
int main(int argc, char **argv) {
printf("%d\n", test());
return 0;
}
When compiled ...
- 2,629
4
votes
Accepted
Inline assembly does not compile
Yes 01311723 is a constant and compiler will not know what it is
Neither would compiler know what jmpBackAddy is
for constant you need to replace it with a label and define the label
for a ...
- 16.3k
4
votes
print [B byte array in frida js script
Frida's java byte array element representation is signed number currently. Therefore, your byte array may contain negative number. We should edit accepted answer to reflect this:
var buffer = Java....
- 141
4
votes
Accepted
How to hook to a system function
Two possibilities:
Patch the call instruction to point to a destination of your choosing, such as a "code cave" between the end of the .text section and the subsequent section. Write your ...
- 9,168
3
votes
Calling a function of a game inside a function hook
In addition to Igor's answer I would like to suggest an alternative approach:
If the function you're trying to call indeed expects some additional preparations, specific conditions for global game ...
- 11.7k
3
votes
Accepted
Calling a function of a game inside a function hook
The problem is that the game's functions are usually expected to be called only in certain circumstances. If you're calling a function at a time when it's not prepared for it, the game's state may be ...
- 36.4k
3
votes
How to add code to compiled java class
There are several ways to achieve this:
Decompile .class to .java source (not necessarily original source, but equivalent), make your changes, compile again. There are many Java decompilers out there,...
- 36.4k
3
votes
Winapi ReadFile monitor
Why not use existing tools to do the job?
If you're just trying to monitor which files get accessed I would suggest to use Process Monitor: Process Monitor is an advanced monitoring tool for Windows ...
- 3,198
3
votes
Can this method be hooked in iOS?
You can hook this method (and most other methods) in iOS if codesigning enforcement is turned off in the kernel, e.g. on a jailbroken iOS device. The way to do this is to overwrite the first few ...
- 146
3
votes
Accepted
Reversing: DeviceIoControl return value
Why would you want to reverse engineer a well-documented function? The underlying mechanism, IOCTLs, are explained as part of the documentation for device drivers. Even the native function underlying ...
- 10.9k
3
votes
Calculation of jmp address through subtraction
E9 is a relative jump and since it was supposed to be inserted at the beginning of the function then sub-tracting the two addresses is the way to go for calculating the difference in bytes.
Why ...
- 4,912
3
votes
Accepted
Hook naked function with CPU registers
There is no instruction for pushing xmm registers, but you can do as follow:
__asm
{
sub esp, 16
movdqu [esp], xmm0
sub esp, 16
movdqu [esp], xmm1
pushad
}
...
- 1,848
3
votes
Accepted
Hooking IAT in remote process with Python?
I cross-posted this to another community that I'm a part of and ended up getting my answer (I should have done this sooner..):
It was likely that my code was getting garbage collected, hence the lock ...
- 51
2
votes
How would I go about getting an application's XMPP request before it is SSL-encrypted?
Thanks for providing a good amount of context in your question.
Yes, hooking is the way to go. The function that you'd want to hook is the function that performs the SSL encryption, as it would be ...
- 20.7k
2
votes
MSDetour not detouring SHGetKnownFolderPath
DetourFunction() is from an older version of Detours. Probably best to upgrade to the latest version of the library. (The equivalent function is now DetourAttach().)
If you're using DetourFunction(...
- 20.7k
2
votes
What methodology can be used to change code flow atomically during program execution?
Here's an older article on how hotpatching was implemented in Windows. If you want it done absolutely atomically, it has to be done from the kernel mode. There's no way around it. Here's the ...
- 1,639
2
votes
What methodology can be used to change code flow atomically during program execution?
This is a good question, and I would argue there is no 100% safe method to patch a running windows process, unless you actively debug it, and even then there are probably edge cases. You could ...
2
votes
Accepted
How do I call a statically imported function from a Dll? call dword ptr ds <> not working
It appears you've already guessed what the actual issue is - your call instruction is using direct addressing and not relative addressing. This means that when a DLL changes it's location between ...
- 11.7k
2
votes
hooking sleep & beep syscalls
not sure what you mean
dot will always sound like dot wont it ?
so logically it will always have the same frequency and same duration ?
like wise dash will always sound like dash ?
if it varied ...
- 16.3k
2
votes
How to add code to compiled java class
You can use JByteMod to edit your class bytecode.
You can also create new methods, delete methods, fields and change accesses.
Its pretty easy to use, just load the jar and select the class you want ...
- 141
2
votes
Accepted
Help with anti-disassembly trick inside a hooked function
There is no obfuscation here, it is a fairly standard jump to a fixed address.
Breaking it down:
FF 25 00 00 00 00 ; jmp qword ptr [rip]
68 01 4A 00 00 00 00 00 ; dq 00000004A0168h
The ...
- 851
2
votes
print [B byte array in frida js script
One liner
console.log(Java.use("java.util.Arrays").toString(ret));
- 21
2
votes
Accepted
Trying to hook DirectX9 using C++ - Keeps crashing
I figured it out, reversed the binary in IDA, found the module address and the EndScene function aswell as its address, calculated the offset. Then used ollydbg and found the function again, made a ...
- 195
2
votes
Calculation of jmp address through subtraction
I don't have access to the book so let's say func1 starts at address 0x10 and func2 starts at 0x30. The distance between func2 and func1 is therefore 0x20 bytes.
If you want to jump from the ...
- 233
2
votes
Accepted
Why does vmt hooking not work with instance member in the following case?
The problem is the way you reference this object with a new pointer.
Derived obj = *ptr;
This actually creates a new object utilizing the data of the old object. Yay! C++!
In line 27 you can see ...
- 2,896
2
votes
Hiding a file in a Windows operating system
There are ways to do it without resorting to hooking or drivers.
For example alternate data streams (ADS), or creating files with "illegal", i.e. reserved, names (NUL, CON ... trailing ., alternative ...
- 10.9k
2
votes
Frida reading files is slow
The reason why your code is slow is not Frida but your code. Your code would be also slow when executed in plain J2SE Java.
The simple reason is because you are reading the file byte by byte using an ...
- 917
Only top scored, non community-wiki answers of a minimum length are eligible