Confusing hook..

Hi.

I'm currently losing my mind trying to hook a function so any help at all would be greatly appreciated.

First off, I don't want to use a DLL because I want to try something different for once.

So far what I've done is, allocate some memory so I can write my own function, and create a jump at the beginning of the function I'm hooking. This is where I got confused. I now want to use this function I'm hooking in my own function, how would I do this?

Since I created a jump at the beginning it's just going to keep coming back to my own function.

So, my question is. Is there a way to hook a function but still use that function normally somewhere else in the same process?

Also, another question somewhat related to this. Is there a way to find out how big the function is automatically? When I say automatically I don't mean with some Windows function. I mean, is there some way to tell many bytes a function has up to the next 'RETN' instruction?

I was thinking of reading the bytes until it finds 'C3' but if you guys have any other suggestions that would be nice. (Not sure if C3 correct for 'RETN').

I hope you understand what I'm asking for here, it's rather confusing.

Thank you.

MS Detours: Detours - Microsoft Research

All you will need. If you have any problems there are plenty of 3rd party Detour classes.

Originally Posted by Dave84311

MS Detours: Detours - Microsoft Research

All you will need. If you have any problems there are plenty of 3rd party Detour classes.

He doesn't want to use detours because he feels it is the easy way out =)

Originally Posted by zeco

He doesn't want to use detours because he feels it is the easy way out =)

Quiet zeco. The almighty Dave is in our mist. His word is law. >:L

David you can call a function within itself. It's called a recursive call, but your trying to hook GetTime or something like that aren't you? I'll see what I can do, but you might want to just go with Detours like Dave says =/

Originally Posted by why06

Quiet zeco. The almighty Dave is in our mist. His word is law. >:L

David you can call a function within itself. It's called a recursive call, but your trying to hook GetTime or something like that aren't you? I'll see what I can do, but you might want to just go with Detours like Dave says =/

No, but the problem is, he wants the original function to be called, when he calls it. Which is problematic, because when he calls it now, he goes to his hooked function.

It's not that I want to call a function within itself, it's that. I created a jump at the beginning of the function so now when ever I want to call it it's going to redirect me to my own function.

Originally Posted by Void

It's not that I want to call a function within itself, it's that. I created a jump at the beginning of the function so now when ever I want to call it it's going to redirect me to my own function.

Why don't you set a local variable before you make the jump. check if the variable is set before the jump and if it is execute the regular function. instead of your altered one.

Originally Posted by why06

Why don't you set a local variable before you make the jump. check if the variable is set before the jump and if it is execute the regular function. instead of your altered one.

but i believe the regular function no long exists, cause he wrote the jump over it(So now if he calls the function, whereas normally the function would commence, now the first instruction at the start of the function is a jump to the new one.)

Originally Posted by zeco

but i believe the regular function no long exists, cause he wrote over it. With the jump.(I think)

Better yet... why not call the function before you hook it. Save whatever you need from it and then hook it call back the save result alter it then release the hook....

The function I'm hooking is being used all the time. It's useless if I can only use it once.

Originally Posted by Void

The function I'm hooking is being used all the time. It's useless if I can only use it once.

Is there a reason you don't want to detour the function? The only method I've ever seen for hooking any of the get time functions was done by detouring. That's how HD did it I know... I don't see why you don't want to use detour... its a lot easier then wht your trying to do...

I have a feeling that if you don't use it your basically going to be rewriting Detour urself =/

Code:

int returnvalue;
__asm
{
    MOV ECX, DWORD PTR DS:[10001690]; //function addy
    //insert the original 5 bytes here, from before you patched them
    CALL DWORD PTR DS:[ECX+5]; //call just past ur jmp
    MOV returnvalue, EAX; //MOV EAX(return value) into returnvalue
}

should do the job, so say the function's at 0x10001690, your detour is 5 bytes( JMP = 1, address it jumps to = 4, so 5 total):

Code:

int retval;
__asm
{
    MOV ECX, DWORD PTR DS:[10001690]; //move the function address into ECX
     //insert the original 5 bytes here, from before you patched them
    CALL DWORD PTR DS:[ECX+5]; // call ECX + 5(so just past your jump)
    MOV retval, EAX; //move the returnvalue(stored in EAX) into retval
}

Might be a bit off with the syntax tho

Thank you HD.

But, how would I incorporate that in my program without direct access to the other process?

If there even is a way of course...

Originally Posted by Void

Thank you HD.

But, how would I incorporate that in my program without direct access to the other process?

If there even is a way of course...

I asume ur using writeprocessmemory to write the jmp right?
do the same for the ASM I wrote above

open up olly, place my ASM somewhere, don't copy it to the executable tho, then just copy the bytes and use writeprocessmemory to insert those

Originally Posted by Hell_Demon

I asume ur using writeprocessmemory to write the jmp right?
do the same for the ASM I wrote above

open up olly, place my ASM somewhere, don't copy it to the executable tho, then just copy the bytes and use writeprocessmemory to insert those

hmm, Is there a way to place the inline ASM at a certain location? Or find it's location? I'm just wondering if there is a way to do what you suggested without manually writing the asm somewhere (using olly).

Edit: Ok, I found a way to find the location of the Inline assembly using labels. Using labels, I could most likely find both when the function begins and ends, thus i could know the amount of bytes it encompasses, thus i could use write process memory to place the code somewhere else easily.

Hmm, furthermore, it seems i can find the address of labels outside of the ASM code block. Very interesting indeed.

So basically, using inline assembly, I can locate a label that i have placed somewhere inside my program. This should be useful.

Confusing hook..

Similar Threads

Tags for this Thread