jmp hook

hi!
i have a small request - what is wrong with my hook code?

Code:

hook proc from:dword, to:dword, len:word
mov edx, dword ptr ds:from
mov eax, dword ptr ds:to
sub eax, edx
sub eax, dword ptr ds:len
mov [ofs], eax
mov byte ptr ds:[from], 0e9h
inc from
mov [from], eax
ret 0ch
hook endp

nothing happens upon injection

Originally Posted by bluedog9

hi!
i have a small request - what is wrong with my hook code?

Code:

hook proc from:dword, to:dword, len:word
mov edx, dword ptr ds:from
mov eax, dword ptr ds:to
sub eax, edx
sub eax, dword ptr ds:len
mov [ofs], eax
mov byte ptr ds:[from], 0e9h
inc from
mov [from], eax
ret 0ch
hook endp

nothing happens upon injection

First of this is the Cpp section, take the asm questions to the assembler section.

Next, there are a few things wrong with this code, for instance:

Code:

hook proc from:dword, to:dword, len:word
mov edx, dword ptr ds:from
mov eax, dword ptr ds:to

I assume that to and from are not pointers to the addresses you want to hook. So if you supply the addresses like:

Code:

push 401000h
push 41h00kh
call hook

Code:

mov edx, dword ptr ds:from

Will not hold 401000h as the address to be hooked, but the dword this address points to. The same is true for the to variable.

it stil not working...

Code:

hook proc from:dword, to:dword
push eax
push edx
mov edx, from
mov eax, to
sub eax, edx
sub eax, 5
mov [from], 0e9h
inc from
mov [from], eax
pop edx
pop eax
ret 8
hook endp

Originally Posted by bluedog9

it stil not working...

Code:

hook proc from:dword, to:dword
push eax
push edx
mov edx, from
mov eax, to
sub eax, edx
sub eax, 5
mov [from], 0e9h
inc from
mov [from], eax
pop edx
pop eax
ret 8
hook endp

Are you sure the memory is writable? Check this proc as a reference (MASM).

Code:

Hook PROC argAddress:DWORD, argDestination:DWORD

LOCAL tmp0:DWORD

push ebx
push esi

mov ebx,argAddress
mov esi,argDestination

sub esi,ebx
sub esi,5

lea eax,tmp0
invoke VirtualProtect,ebx,5,PAGE_EXECUTE_READWRITE,eax

mov byte ptr [ebx],0E9h
mov dword ptr [ebx+1],esi

lea eax,tmp0
mov ecx,dword ptr [eax]
invoke VirtualProtect,ebx,5,ecx,eax

pop esi
pop ebx
ret

Hook ENDP

jmp hook

Post a Reply

Similar Threads

Tags for this Thread