Originally Posted by
Code[VB]
you can´t hook with a while loop.. lol..
becouse you can´t run your thread or function all the time,.. you have to hook, then call your function (with CALL) then go outside, reset that things you hooked and hook it again, call your function... and so on..
and the bytes you ned have to be 6 long.. and not 5!!
I'm not sure how I should interpret your first statement. You can hook from within a while loop, and you can insert a mid function hook inside of a while loop.
becouse you can´t run your thread or function all the time
Again, this statement is difficult to understand, however a hook is independent of the installing thread - the executing thread traveling the detour is that which is affected in regards to its path of execution. The installing thread will typically not travel the path of the detour (but it can without any problems...)
the bytes you ned have to be 6 long.
On a 32 bit machine, a short jump is two bytes, and a far jump is 5 bytes, there are near jumps as well, so its dependent on what sort you're talking about regarding its size. On a 64 bit machine it would be probably about two times the size(as the offsets are much larger...)
Use common sense; an offset, regardless to however far, will not be larger than four bytes (because 0xFFFFFFFF is the max address.) So you have four bytes for the operand and one byte for the instruction, so 5 bytes. Maybe 6 if you have applied sort of modifier to the jump(and if one even exists, but I haven't ever seen one.)
Edit
Ahh, you're talking about conditional jumps, they can be upto 6 bytes - there is a very distinct difference between the two. You usually don't use conditional jumps in a detour but I suppose you could(i don't know how you would execute the stolen bytes though...) The extra byte is found in the opcode in a conditional jump.
Originally Posted by
Jason
Someone needs to make a generic midfunction hook that can applied to any base address and will intuitively find a point in *roughly* the middle of the function to place a hook which:
Code:
a) isn't in a conditional location (i.e not after a conditional jmp, which may be skipped)
b) isn't just whacked in at offset X from the beginning of the function (that is, intuitively detects part "a" and also that the location isn't in the middle of an instruction)
c) is easily useable (class the hook, constructors consist of function address, detour address and optionally how far into the function you want the scan to start)
Since I have 3-4 months of holidays coming up I might give it a shot, but I'd have to probs learn ASM too haha. Hardest part would be recognizing the various instruction lengths and detecting conditional blocks of code, as well as when the end of the function is reached (so you don't continue scanning indefinitely, or put a hook in a random location in another function and crash the program.
That isn't possible. The point of a detour is to alter arguments or the return value, unless this isn't the point, then it isn't possible. The reason being is that a mid-function detour is established at a point where either the arguments haven't yet been processed or that they have but the effect of them being process can be reversed and then re performed with altered arguments. I suppose one could programatically find a convenient place for a mid-function detour but the logic behind locating it would be a complete hell to program(I had to build instruction dependency trees with my polymorhpism engine and it was quite a bit of work on its own.)
The reason universal detours can be made on the first executing instructions of any function using any calling convention is because the function hasn't yet been executed - all that needs to be done is to have the function redirected to a stub which alters the arguments passed to it and then allow it to continue execution.
