| View previous topic :: View next topic |
| Author |
Message |
Ferocious
Advanced Cheater
 Reputation: 0
Joined: 06 Feb 2008
Posts: 54
|
|
| Back to top |
|
 |
Estx
Expert Cheater
 Reputation: 0
Joined: 04 Mar 2008
Posts: 172
|
 Posted: Thu May 08, 2008 9:17 am Post subject: |
 |
|
Just for those who are unsure of the term "Trampoline" in the coding field, check out:
http://en.wikipedia.org/wiki/Trampoline_%28computers%29
Basically it's just when you detour a function to your own; "bouncing" information to another procedure.
The term bounce is logical.. Kind of like a boomerang. The trampoline makes the function send information to your procedure, which is then returned back to the original location.
Probably not a good explanation, but the best that I can offer at this time of the morning lol.
--
Haven't downloaded the file, but I'm assuming that's what this is about.
|
|
| Back to top |
|
|
Ferocious
Advanced Cheater
Reputation: 0
Joined: 06 Feb 2008
Posts: 54
|
| Posted: Fri May 09, 2008 2:25 am Post subject: |
|
|
thanks for the heads up estx
it seems not many are interested in this method.
|
|
| Back to top |
|
|
Noz3001
I'm a spammer
 Reputation: 26
Joined: 29 May 2006
Posts: 6220
Location: /dev/null
|
| Posted: Fri May 09, 2008 2:37 am Post subject: |
|
|
Just read through it. Good documentation on it, i'm sure it will help people trying to learn hooking & anti-hooking techniques.
PS. Can you upload the pdf in zip or something so i can get it at college?
|
|
| Back to top |
|
|
Estx
Expert Cheater
Reputation: 0
Joined: 04 Mar 2008
Posts: 172
|
| Posted: Fri May 09, 2008 7:09 am Post subject: |
|
|
The method is very popular amongst advanced coders.
I use it quite a lot in my programming, extremely useful.
Attached the .zip for noz3001, refresh if you can't see it.
|
|
| Back to top |
|
|
Ferocious
Advanced Cheater
Reputation: 0
Joined: 06 Feb 2008
Posts: 54
|
| Posted: Fri May 09, 2008 7:51 am Post subject: |
|
|
| estx wrote: | | The method is very popular amongst advanced coders. |
yeah, i am aware of that, as a new comer in cef, the definition of "not interested in this method" is, not many tend to discuss on this method, in this thread. that's all.
|
|
| Back to top |
|
|
4ng3licDew
Cheater
![]() Reputation: 0
Joined: 14 Feb 2008
Posts: 28
|
| Posted: Thu May 15, 2008 9:45 am Post subject: |
|
|
@Ferocious: Thank you for sharing this info.
I am reading Detours 1.5 documentation right now. It mentions your technique and more. I would highly recommend people to download detours 1.5 and check it out. The file detour.exe contains the source codes, binary files, documentation and sample codes.
http://research.microsoft.com/research/downloads/Details/10e5d78c-592c-419d-a53e-bae8dbd81801/Details.aspx
(If this link does not work, you can try using google to search for Detours 1.5)
Detour provides you with the high level abstraction so you don't have to worry about coding in asm. You still need to know C/C++ though.
I first learn of Detour from wiccaan's exellent tutorial:
[TUT] DirectX9.0 Hooking via Detours + Custom Wrapper
http://forum.cheatengine.org/viewtopic.php?t=161045
|
|
| Back to top |
|
|
atom0s
Moderator
 Reputation: 205
Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
|
|
| Back to top |
|
|
4ng3licDew
Cheater
![]() Reputation: 0
Joined: 14 Feb 2008
Posts: 28
|
| Posted: Sat May 17, 2008 7:33 am Post subject: |
|
|
Here is quote from Smart Computing Article:
http://www.smartcomputing.com/editorial/article.asp?article=articles%2F2006%2Fs1702%2F01s02%2F01s02.asp
| Quote: |
Programming hooks into Windows applications is a nifty way of intercepting an event before it reaches your application, and if you’ve explored the world of hooks in the past, you’re probably already familiar with SetWindowsHookEx and other basic functions that can let you set a hook procedure into a hook chain or insert a DLL (dynamic-link library) into another process. But while hooks are useful for basic functions, Microsoft’s Detours library takes such procedures to a whole new level.
The Detours library not only lets you intercept arbitrary Win32 binary functions, but it also gives you the ability to edit import tables and attach arbitrary data segments to binary files. When intercepting binary functions, the Detours library works to intercept target functions by actually rewriting their in-process binary image, creating two functions for each target function (the target function and matching trampoline function). From here, you can allocate the trampoline function either dynamically or statically.
|
Attached to this message is Detours 1.5 and Detour Express 2.1, license for research, non-commercial, and non-production use on 32-bit code.
There is a license version; Detours Professional 2.1 from
http://research.microsoft.com/sn/detours/
| Quote: |
Detours Professional 2.1 includes a license for use in production environments and the right to distribute detour functions in products. In addition to support for 32-bit x86 code, Detours Professional 2.1 includes support for 64-bit code on x64 and IA64 processors. For information on licensing Detours Professional 2.1 contact Microsoft's IP Licensing Group at [email protected]
|
Enjoy 
Edit: Other useful links I found
1) API Spying Techniques for Windows 9x, NT and 2000
By Yariv Kaplan
http://www.internals.com/articles/apispy/apispy.htm
2) Blackout: What Really Happened
By Jamie Butler and Kris Kendall
https://www.blackhat.com/presentations/bh-usa-07/Butler_and_Kendall/Presentation/bh-usa-07-butler_and_kendall.pdf
3) API hooking revealed
By Ivo Ivanov
http://www.codeproject.com/KB/system/hooksys.aspx
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
