Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


[Help] Hooking in C++

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
rapion124
Grandmaster Cheater Supreme
Reputation: 0

Joined: 25 Mar 2007
Posts: 1095
PostPosted: Tue Mar 11, 2008 4:22 pm    Post subject: [Help] Hooking in C++ Reply with quote
I'm trying to make a hook for kernel32 and user32 APIs. I wrote the hook handlers already. This is how they look:

Code:

BOOL __declspec(naked) WINAPI IsDebuggerPresent()
{
    //Hook handler goes here
}


Now, how do I install the hook? I can't find an opcode that jumps to an absolute address. Most jumps are relative to the address such as jmp +$1C.
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1
PostPosted: Wed Mar 12, 2008 2:14 pm    Post subject: Reply with quote
Replace the JMP in the IAT table? You could also detour each and every call to the API if you wanted.
_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
Flyte
Peanuts!!!!
Reputation: 6

Joined: 19 Apr 2006
Posts: 1887
Location: Canada
PostPosted: Wed Mar 12, 2008 10:32 pm    Post subject: Reply with quote
Wiccaan wrote:
Replace the JMP in the IAT table? You could also detour each and every call to the API if you wanted.


What happens when they call it after dynamically resolving it with GetProcAddress()? Wink

Anyways, the formula for making a JMP is: to - from - 5
Back to top
View user's profile Send private message
Cx
Master Cheater
Reputation: 0

Joined: 27 Jul 2007
Posts: 367
PostPosted: Wed Mar 12, 2008 11:33 pm    Post subject: Reply with quote
Flyte wrote:
Wiccaan wrote:
Replace the JMP in the IAT table? You could also detour each and every call to the API if you wanted.


What happens when they call it after dynamically resolving it with GetProcAddress()? Wink

Anyways, the formula for making a JMP is: to - from - 5

Not always... aren't there 6 byte jump instructions?
Think of it as (Destination Address - Address After Jump Instruction).
_________________

armed with this small butterfly net
i will face the world alone
& never be lonely.
Back to top
View user's profile Send private message
rapion124
Grandmaster Cheater Supreme
Reputation: 0

Joined: 25 Mar 2007
Posts: 1095
PostPosted: Thu Mar 13, 2008 4:37 pm    Post subject: Reply with quote
Is there a "jump absolute." For example, 0xE9 jumps are different at different addresses even if the opcode is the same. I need a jump absolute that is the same for any address.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites