[Help]Hooking Functions
[Help]Hooking Functions
Does hooking a function have to do anything with ASM?
If not where would be a good place to start learning?
If not where would be a good place to start learning?
No, though you can use assembly to hook. It involves finding the address of a function and hooking it by jumping to your own code and back again. Most hackers use Detours Library to do this since that way all we have to worry about is finding the address and then arguments it takes so we can create a function to handle those arguments. Though Hooking is extremely easy even without classes. It essentially involves writing EB 0xAddress in the beginning of the function call to jump to your function which would be 0xAddress.
There's lots of different ways to hook though. For certain Windows API, and common functions that show up in the IAT, its possible to overwrite the IAT to jump to your own code. I've also seen patching the jump thunk table, using execptions, Hardware breakpoint hooks, etc. But though the techniques can change the basic principle is the same.
There's lots of different ways to hook though. For certain Windows API, and common functions that show up in the IAT, its possible to overwrite the IAT to jump to your own code. I've also seen patching the jump thunk table, using execptions, Hardware breakpoint hooks, etc. But though the techniques can change the basic principle is the same.
Originally Posted by why06
No, though you can use assembly to hook. It involves finding the address of a function and hooking it by jumping to your own code and back again. Most hackers use Detours Library to do this since that way all we have to worry about is finding the address and then arguments it takes so we can create a function to handle those arguments. Though Hooking is extremely easy even without classes. It essentially involves writing EB 0xAddress in the beginning of the function call to jump to your function which would be 0xAddress.
There's lots of different ways to hook though. For certain Windows API, and common functions that show up in the IAT, its possible to overwrite the IAT to jump to your own code. I've also seen patching the jump thunk table, using execptions, Hardware breakpoint hooks, etc. But though the techniques can change the basic principle is the same.
There's lots of different ways to hook though. For certain Windows API, and common functions that show up in the IAT, its possible to overwrite the IAT to jump to your own code. I've also seen patching the jump thunk table, using execptions, Hardware breakpoint hooks, etc. But though the techniques can change the basic principle is the same.
Not At All i guess.