| View previous topic :: View next topic |
| Author |
Message |
oib111
I post too much
 Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
 Posted: Sun May 18, 2008 7:28 pm Post subject: API hooking |
 |
|
I'm trying to learn how to API hook, but I can't seem to find any good tutorials. There was one tutorial that was bad, but it provided a good quote (or so it seemed to me), but he didn't explain well, or give any code in the tutorial. Now the quote itself is enough to tell me dynamics behind API hooking and how to do it, but not the APIs. The person references some, but not enough for me to know what APIs to use and how I should do this. Anyway...
| Quote: |
1. Develop a dll that will contain an exported function for the API, which you require to monitor/override.
2. Get a process id to a running process, which you need to modify.
3. Open the process with respect to the process id using the OpenProcess API.
4. Create a remote thread (CreateRemoteThread?) inside the running process to control the LoadLibrary functionality of the running process.
5. Execute this thread to ensure that the running process loads your dll into its memory.
6. Once your dll is loaded, and when the dll is attaching, get a pointer to the import list inside the running process. This part is a bit tricky and will require an understanding of how to iterate an Import Table list. To make life easier, there are helper APIs available, which allow you to do this. This will be explained in detail when explaining the code. (there was no code)
7. Now after getting a pointer to the import function and a pointer to the function itself, replace this pointer with a pointer to your function from the dll.
|
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
 |
Ferocious
Advanced Cheater
 Reputation: 0
Joined: 06 Feb 2008
Posts: 54
|
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Sun May 18, 2008 8:34 pm Post subject: |
|
|
First, off, this is very well done. But I do have some questions. For example...
| Code: |
*((signed int*)(pbTargetCode)) = pbReplaced - (pbTargetCode + 4);
|
I understand what it's doing. It dereferences pbTargetCode so your assigning a value to the address being pointed to and not assigning a new address, and your typecasting as an signed int pointer. But I don't get why you're assigning it the value of the replaced address minus the address your hooking plus four. What would the point of that be? Also...
| Code: |
*pbTargetCode++ = 0xE9;
|
I get that you're telling it to jump to the target code, but what's up wit the "++". Also...
| Quote: |
The main idea of this method is to replace the initial 5 bytes of the function with a jump so it jumps to our function instead, creating a hook. |
How do you know how many bytes to replace?
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
 Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Sun May 18, 2008 9:13 pm Post subject: |
|
|
For the last question you asked:
1 Byte for the call/jump (0xE8/0xE9)
4 Bytes for the Addy to jump to.
_________________
|
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Sun May 18, 2008 9:19 pm Post subject: |
|
|
| lurc wrote: | For the last question you asked:
1 Byte for the call/jump (0xE8/0xE9)
4 Bytes for the Addy to jump to. |
So most of the time it will be five bytes. But still, I don't understand the things that I asked in my other questions. And I don't want to be randomly putting in things, without actually knowing why and what they do.
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
Noz3001
I'm a spammer
 Reputation: 26
Joined: 29 May 2006
Posts: 6220
Location: /dev/null
|
| Posted: Mon May 19, 2008 1:38 am Post subject: |
|
|
Normal Sleep:
| Code: |
7C802442 MOV EDI,EDI
7C802444 PUSH EBP
7C802445 MOV EBP,ESP
7C802447 PUSH 0 ; /Alertable = FALSE
7C802449 PUSH DWORD PTR SS:[EBP+8] ; |Timeout
7C80244C CALL kernel32.SleepEx ; \SleepEx
7C802451 POP EBP
7C802452 RETN 4
|
Hooked function:
| Code: | 7C802442 JMP 12345678
7C802447 PUSH 0
7C802449 PUSH DWORD PTR SS:[EBP+8] ; |Timeout
7C80244C CALL kernel32.SleepEx ; \SleepEx
7C802451 POP EBP
7C802452 RETN 4
|
See i've overwritten the 1st 5 bytes with a JMP to my function which is stored at address 12345678.
Here is a hook written for cheatengine's assembler:
| Code: | [enable]
alloc(hook,2048)
alloc(sleeptime, 128)
label(returnhere)
registersymbol(hook)
registersymbol(sleeptime)
sleeptime:
add [eax], al // Sleeptime, edit on CT
hook:
mov edi,edi
push ebp
mov ebp,esp
pushf
// Do whatever dumping now //
mov eax, [ebp+08]
mov edx, hook
add edx, 40
mov [edx], eax
// Stop //
popf
// Change Params //
mov [ebp+08], 5000 // Second param is sleep time
jmp returnhere
// Hook Sleep //
Sleep:
jmp hook
returnhere:
////////////////
[disable]
dealloc(hook)
dealloc(sleeptime)
Sleep:
mov edi,edi
push ebp
mov ebp,esp |
Inject it, open the memory viewer and ctrl+g to Sleep and see what it does.
|
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Mon May 19, 2008 3:03 am Post subject: |
|
|
Thanks noz, I'm trying to learn assembly and this will be helpful. But I'm mainly focused on my other questions.
| Quote: |
| Code: |
*((signed int*)(pbTargetCode)) = pbReplaced - (pbTargetCode + 4);
|
I understand what it's doing. It dereferences pbTargetCode so your assigning a value to the address being pointed to and not assigning a new address, and your typecasting as an signed int pointer. But I don't get why you're assigning it the value of the replaced address minus the address your hooking plus four. What would the point of that be? Also...
| Code: |
*pbTargetCode++ = 0xE9;
|
I get that you're telling it to jump to the target code, but what's up wit the "++".
|
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
Ferocious
Advanced Cheater
Reputation: 0
Joined: 06 Feb 2008
Posts: 54
|
| Posted: Mon May 19, 2008 3:32 am Post subject: |
|
|
pbTargetCode is the address that you are going to hook.
pbReplaced is the address of your function.
we are assigning a jump at the initial bytes of function to your hooking function (pbReplaced)
to your question, basically its just calculating the address of where it's gonna jump.
_________________
I wanna hack, but I don't know how... |
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Mon May 19, 2008 3:41 am Post subject: |
|
|
| Ferocious wrote: | pbTargetCode is the address that you are going to hook.
pbReplaced is the address of your function.
we are assigning a jump at the initial bytes of function to your hooking function (pbReplaced)
to your question, basically its just calculating the address of where it's gonna jump. |
So the replaced address equals our functions address mine itself plus four. I still fail to see the point of that.
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
Noz3001
I'm a spammer
Reputation: 26
Joined: 29 May 2006
Posts: 6220
Location: /dev/null
|
| Posted: Mon May 19, 2008 5:24 am Post subject: |
|
|
| oib111 wrote: | | Ferocious wrote: | pbTargetCode is the address that you are going to hook.
pbReplaced is the address of your function.
we are assigning a jump at the initial bytes of function to your hooking function (pbReplaced)
to your question, basically its just calculating the address of where it's gonna jump. |
So the replaced address equals our functions address mine itself plus four. I still fail to see the point of that. |
Because the 4 bytes after E9 are the offset to the address being jumped to. I can't think of a way to explain it atm.
|
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Mon May 19, 2008 8:51 am Post subject: |
|
|
| Code: |
*pbTargetCode++ = 0xE9;
*((signed int*)(pbTargetCode)) = pbReplaced - (pbTargetCode + 4);
|
You already jumped. I mean I get what you're doing. But I just don't get why you need to do it, if you have already jumped.
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
Noz3001
I'm a spammer
Reputation: 26
Joined: 29 May 2006
Posts: 6220
Location: /dev/null
|
| Posted: Mon May 19, 2008 9:03 am Post subject: |
|
|
| Code: | #define JMP(frm, to) (int)(((int)to - (int)frm) - 5);
DWORD Address = (DWORD)GetProcAddress( LoadLibrary("user32.dll"), "MessageBoxA" );
*(BYTE*)Address = 0xE9; // Set JMP on 1st byte of function
*(int*)(Address+1) = JMP( Address, HookFunction ); // Calculate offset
|
|
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Mon May 19, 2008 5:03 pm Post subject: |
|
|
| noz3001 wrote: | | Code: | #define JMP(frm, to) (int)(((int)to - (int)frm) - 5);
DWORD Address = (DWORD)GetProcAddress( LoadLibrary("user32.dll"), "MessageBoxA" );
*(BYTE*)Address = 0xE9; // Set JMP on 1st byte of function
*(int*)(Address+1) = JMP( Address, HookFunction ); // Calculate offset
|
|
So. Something like this...
| Code: |
400FC72A
-4000A519
---------
0xF2211
+ 4
-------
0xF2215
|
I think. I'm not sure if adding and subtracting is different in hex. Idk. Noz or ferocious if you guys can go on msn and explain it to me it would be nice. Because I'm still not getting it 
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
Ferocious
Advanced Cheater
Reputation: 0
Joined: 06 Feb 2008
Posts: 54
|
| Posted: Mon May 19, 2008 10:52 pm Post subject: |
|
|
yeah that is correct, you just calculated the offset.
and its gonna change that offset to your function address.
_________________
I wanna hack, but I don't know how... |
|
| Back to top |
|
|
DoomsDay
Grandmaster Cheater
 Reputation: 0
Joined: 06 Jan 2007
Posts: 768
Location: %HomePath%
|
| Posted: Tue May 20, 2008 6:31 am Post subject: |
|
|
The 0xE9 byte stands for a jmp, and requires a 4-byte displacement of the distance between the next instruction in the memory and the jumped instruction - this instruction itself is 5-bytes long, hence the -5.
| Code: | 00401000 | E9 00000000 | JMP 00401005
00401005 | E9 | JMP 0040200A |
Last edited by DoomsDay on Tue May 20, 2008 10:27 am; edited 1 time in total |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
