Hot answers tagged

5 votes

Hooking function with frida

Try using Memory.patchCode to achieve this. Here's a short example. int test() { return 1024; } int main(int argc, char **argv) { printf("%d\n", test()); return 0; } When compiled ...
sudhackar's user avatar
  • 2,639
4 votes

Intercept zip decryption key or files from an application

I'm writing this answer under the assumption the OP is within his legal rights to share the binaries. First of, I read up on password protected zip files. Apparently that is not part of the ZIP ...
Johann Aydinbas's user avatar
3 votes

How to see ReadFile results with ProcMon

TLDR; you can't. ProcMon does not record the data which has been read, it only records the API call arguments and return value (such as success or error code). If you want to see the data as well, a ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes

Is it possible to hook CPU instructions without severe performance impact?

Writing an hypervisor The best way to currently do this is by creating a micro-hypervisor, exploiting technologies originally created to support faster virtualization to monitor usermode as well as ...
NirIzr's user avatar
  • 11.8k
2 votes

Create instance of iOS class that contains a . with frida

ObjC.classes.TestClass is just a shorthand in JavaScript for ObjC.classes['TestClass']. Therefore you should be able to access an Test.Class instance this way: var instance = ObjC.chooseSync(ObjC....
Robert's user avatar
  • 1,042
2 votes

Hiding a file in a Windows operating system

There are ways to do it without resorting to hooking or drivers. For example alternate data streams (ADS), or creating files with "illegal", i.e. reserved, names (NUL, CON ... trailing ., alternative ...
0xC0000022L's user avatar
  • 10.9k
2 votes

Why does vmt hooking not work with instance member in the following case?

The problem is the way you reference this object with a new pointer. Derived obj = *ptr; This actually creates a new object utilizing the data of the old object. Yay! C++! In line 27 you can see ...
Nordwald's user avatar
  • 2,896
2 votes

What functions (in which modules) can be hooked by Frida to access unencrypted data of SSL connections in Java programs running under Windows?

That requires some research on your end. Find out what API functions (not Java level) are used on a system level to deal with SSL. I could imagine that the Java runtime on Windows uses the Internet ...
Johann Aydinbas's user avatar
1 vote

Check if instruction is reached

Easy stupid way: patch the instruction with an invalid one, if the program crashes you know the instruction has been hit
Fabian Mendez's user avatar
1 vote

Windbg Break Points

i cant understand what your usecase is assuming you have some code like this running and you want to break when some thing is written to some space you can use ba (hardware assisted breakpoint ) ...
blabb's user avatar
  • 16.3k

Only top scored, non community-wiki answers of a minimum length are eligible