Mid-Hook Function Help [Solved]

Oh lol, ok i will remember to do so. Also, is this just for any windows function or do i have to do it for a function i made too. Like let's say i made a function in my dll called "void SomeFunction(void);", would i have to call it as a dword ptr also?

I wish I had Visual C++ installed on this machine (My laptop's charger is faulty atm so I have to use my secondary PC.) so I could show why you're calling it as a dword-ptr.

I didn't know your project was a dll, had I known troubleshooting this would have been a lot easier xd, so it actually does make sense that you're calling functions in your own modules via the Jump Thunk Table (a dll can be loaded at numerous different base addresses) - So yes, you will have to call it as a dword ptr.

Oh, ok, so it's because since my dll won't always have the same base address so i must call it as a pointer in order for it to know where the function is this time. That makes sense. Thanks Jetamay.

you can´t hook with a while loop.. lol..
becouse you can´t run your thread or function all the time,.. you have to hook, then call your function (with CALL) then go outside, reset that things you hooked and hook it again, call your function... and so on..
and the bytes you ned have to be 6 long.. and not 5!!

Dude, why you always stalkin my threads and saying things that you don't even know what they mean. Obviously i don't have a while loop in my Dllmain in my real hack I just put it here and some other little errors so noobs like you can't copy and paste.

Secondly a midfunction hook needs 5 bytes. Don't just say stuff that you get from other threads and not actually research them on your own. You just gt the idea of 6 bytes from Brimir's thread, and i corrected him and told him it was 5 bytes and he said that he made a mistake. This just proves that you know nothing about asm. You need 1 byte for the JMP which is 0xE9 then 4 bytes for the jump to my function which is the size of a DWORD. So just in case you didn't already notice: 1 + 4 = 5.

Thirdly, i don't need to make a CALL because i can just make a jump to my function and restore the bytes in my function then jmp back at the end of my function.

So stop replying to my threads becaue your little scheme of making me look bad isn't working because yet again you have made your self look stupider than everybody already thought you were.

Obviously you're an idiot cuz you can't read. I already said that i have got it working. Lol, i don't think you even fully grasp this concept of mid func hooking. I have used this method to create a base for cf, i don't think you can say the same for yourself, so go troll on someone else's thread.

@Hassan /req close, Only flaming is happening here, my issue is solved.

Well, you can make a universal midfunc hook, cuz most programs and games, use the KERNELBASE.dll and then you can just hook the prologue or anywhere in the function of GetExitCodeThread cuz it runs many times within a game. Just make sure to restore the bytes cuz the app will get pissed at you then close, lol.

When the hell did this become a competition? Omg, i swear some people on this site drive me nuts.
Don't be jealous fool. Anyone can use topblasts base. So stop posting here cuz your replies aren't helpful to this topic, and there are other people who have wanted to learn this method of hooking and can't because of all the crap you're posting.

I'm not sure how I should interpret your first statement. You can hook from within a while loop, and you can insert a mid function hook inside of a while loop.

Again, this statement is difficult to understand, however a hook is independent of the installing thread - the executing thread traveling the detour is that which is affected in regards to its path of execution. The installing thread will typically not travel the path of the detour (but it can without any problems...)

On a 32 bit machine, a short jump is two bytes, and a far jump is 5 bytes, there are near jumps as well, so its dependent on what sort you're talking about regarding its size. On a 64 bit machine it would be probably about two times the size(as the offsets are much larger...)

Use common sense; an offset, regardless to however far, will not be larger than four bytes (because 0xFFFFFFFF is the max address.) So you have four bytes for the operand and one byte for the instruction, so 5 bytes. Maybe 6 if you have applied sort of modifier to the jump(and if one even exists, but I haven't ever seen one.)

Edit
Ahh, you're talking about conditional jumps, they can be upto 6 bytes - there is a very distinct difference between the two. You usually don't use conditional jumps in a detour but I suppose you could(i don't know how you would execute the stolen bytes though...) The extra byte is found in the opcode in a conditional jump.

That isn't possible. The point of a detour is to alter arguments or the return value, unless this isn't the point, then it isn't possible. The reason being is that a mid-function detour is established at a point where either the arguments haven't yet been processed or that they have but the effect of them being process can be reversed and then re performed with altered arguments. I suppose one could programatically find a convenient place for a mid-function detour but the logic behind locating it would be a complete hell to program(I had to build instruction dependency trees with my polymorhpism engine and it was quite a bit of work on its own.)

The reason universal detours can be made on the first executing instructions of any function using any calling convention is because the function hasn't yet been executed - all that needs to be done is to have the function redirected to a stub which alters the arguments passed to it and then allow it to continue execution.

I wish we could have universal mid-function detours as well

Thanks man. Now people can read and learn without having to filter through stupid flame posts. That's why ur the minion, haha.