| View previous topic :: View next topic |
| Author |
Message |
oib111
I post too much
 Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
 Posted: Fri Jul 25, 2008 12:13 pm Post subject: hooking program defined functions |
 |
|
How do you hook program defined functions? Can you use the hotpatching method? Otherwise how can you hook them?
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
 |
HalfPrime
Grandmaster Cheater
![]() Reputation: 0
Joined: 12 Mar 2008
Posts: 532
Location: Right there...On your monitor
|
| Posted: Fri Jul 25, 2008 1:11 pm Post subject: |
|
|
It's the same thing. Just make sure you know what the first 5 bytes are. It's pretty much just the same thing as a code-cave except you'll probably be routing into your program instead of the host.
_________________
|
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Fri Jul 25, 2008 1:35 pm Post subject: |
|
|
How exactly do I figure out what the first five bytes are? I know I probably have to step into the function call and look at its disassembled code. But how do I figure out how many lines of it are the first five bytes?
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
HalfPrime
Grandmaster Cheater
![]() Reputation: 0
Joined: 12 Mar 2008
Posts: 532
Location: Right there...On your monitor
|
| Posted: Fri Jul 25, 2008 2:03 pm Post subject: |
|
|
You'll just have to figure it out. The first byte is going to be the command, so look it up and see what is and how many bytes it's going to take up.
If you can attach with CE to see what it is, it would make it a lot easier for you.
_________________
|
|
| Back to top |
|
|
Ferocious
Advanced Cheater
 Reputation: 0
Joined: 06 Feb 2008
Posts: 54
|
|
| Back to top |
|
|
HalfPrime
Grandmaster Cheater
![]() Reputation: 0
Joined: 12 Mar 2008
Posts: 532
Location: Right there...On your monitor
|
| Posted: Fri Jul 25, 2008 2:32 pm Post subject: |
|
|
That's the first 5 bytes for most API to make hotpatching easier. We're talking about functions inside the program.
_________________
|
|
| Back to top |
|
|
Ferocious
Advanced Cheater
Reputation: 0
Joined: 06 Feb 2008
Posts: 54
|
| Posted: Fri Jul 25, 2008 3:02 pm Post subject: |
|
|
yes, they are the same actually,
lets take this routine for example (it prints string to a buffer) :
| Code: | .text:00401000 sub_401000 proc near ; CODE XREF: _main+36p
.text:00401000 DstBuf = dword ptr 4
.text:00401000 Format = dword ptr 8
.text:00401000 ArgList = byte ptr 0Ch
.text:00401000 8B 4C 24 08 mov ecx, [esp+Format]
.text:00401004 8D 44 24 0C lea eax, [esp+ArgList]
.text:00401008 50 push eax ; ArgList
.text:00401009 8B 44 24 08 mov eax, [esp+4+DstBuf]
.text:0040100D 6A 00 push 0 ; Locale
.text:0040100F 51 push ecx ; Format
.text:00401010 52 push edx ; MaxCount
.text:00401011 50 push eax ; DstBuf
.text:00401012 FF 15 9C 20 40 00 call ds:__imp___vswprintf_c_l
.text:00401018 83 C4 14 add esp, 14h
.text:0040101B C3 retn
.text:0040101B sub_401000 endp
|
as you can see the initial 5 bytes are :
| Quote: | .text:00401000 sub_401000 proc near ; CODE XREF: _main+36p
.text:00401000 DstBuf = dword ptr 4
.text:00401000 Format = dword ptr 8
.text:00401000 ArgList = byte ptr 0Ch
.text:00401000 8B 4C 24 08 mov ecx, [esp+Format]
.text:00401004 8D 44 24 0C lea eax, [esp+ArgList]
.text:00401008 50 push eax ; ArgList
.text:00401009 8B 44 24 08 mov eax, [esp+4+DstBuf]
.text:0040100D 6A 00 push 0 ; Locale
.text:0040100F 51 push ecx ; Format
.text:00401010 52 push edx ; MaxCount
.text:00401011 50 push eax ; DstBuf
.text:00401012 FF 15 9C 20 40 00 call ds:__imp___vswprintf_c_l
.text:00401018 83 C4 14 add esp, 14h
.text:0040101B C3 retn
.text:0040101B sub_401000 endp
|
those are the initial 5 bytes.
as you can see here, if you replace the 5 bytes, you are going to screw up the operation sequence thus crashing the application.
to overcome this issue, IAT hooks could do the job 
EDIT: if you are going to hook program defined functions you will not get thr function's name because function names that are obvious like MessageBox, SendMessage, etc. etc is loaded from Microsoft's debug symbol a.k.a PDB files - http://msdn.microsoft.com/en-us/library/yd4f8bd1(VS.71).aspx
_________________
I wanna hack, but I don't know how... |
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Fri Jul 25, 2008 3:12 pm Post subject: |
|
|
Doesn't IAT mean Import Address Table. And doesn't that mean that you can only use IAT hooks on functions in the Import Table, which would really only be APIs or program and or defined functions in a DLL.
Btw, I thought with hotpatching, the original 5 bytes are:
| Code: |
mov edi, edi
push ebp
mov ebp, esp
|
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
Ferocious
Advanced Cheater
Reputation: 0
Joined: 06 Feb 2008
Posts: 54
|
| Posted: Fri Jul 25, 2008 3:17 pm Post subject: |
|
|
yes you are correct. I am saying this in term of imported functions, Detouring is the answer then.
here's a simple tutorial by DrDeath of the GameDeception : http://forum.gamedeception.net/showthread.php?t=11581
EDIT : sorry for the misleading information about IAT, you will have to use other method to overcome the issue.
_________________
I wanna hack, but I don't know how... |
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Fri Jul 25, 2008 3:51 pm Post subject: |
|
|
Any way to do it without using the detours library?
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
HalfPrime
Grandmaster Cheater
![]() Reputation: 0
Joined: 12 Mar 2008
Posts: 532
Location: Right there...On your monitor
|
| Posted: Fri Jul 25, 2008 3:59 pm Post subject: |
|
|
| Quote: | | yes, they are the same actually, |
| Quote: | as you can see here, if you replace the 5 bytes, you are going to screw up the operation sequence thus crashing the application.
|
You're contradicting yourself.
If you look at a function inside a program, they're all going to start differently.
_________________
|
|
| Back to top |
|
|
samuri25404
Grandmaster Cheater
 Reputation: 7
Joined: 04 May 2007
Posts: 955
Location: Why do you care?
|
| Posted: Fri Jul 25, 2008 4:04 pm Post subject: |
|
|
| Code: |
#define MakeJmp(from,to) to-from+5 //I forget this part, just guessing
#define Address 0xDEADBEEF
static BYTE[5] bOriginalBytes;
void PatchFunction() {
for (BYTE *bAddr = Address, DWORD dwCount = 0; dwCount < 5; bAddr++, dwCount++) {
bOriginalBytes[i] = *bAddr;
}
*((BYTE *)Address) = 0xE8; //jmp instruction
*((DWORD *)(Address + 1)) = MakeJmp((Address+1), NewFunction); //I think
}
void FixFunction() {
for (BYTE *bAddr = Address, DWORD dwCount = 0; dwCount < 5; bAddr++, dwCount++) {
*bAddr = bOriginalBytes[i];
}
}
|
_________________
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
 Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Fri Jul 25, 2008 4:10 pm Post subject: |
|
|
| Code: | | #define MakeJmp( to, from ) to - from - 5 |
Just a little fix.
_________________
|
|
| Back to top |
|
|
Flyte
Peanuts!!!!
 Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Fri Jul 25, 2008 4:15 pm Post subject: |
|
|
| samuri25404 wrote: | | Code: |
#define MakeJmp(from,to) to-from+5 //I forget this part, just guessing
#define Address 0xDEADBEEF
static BYTE[5] bOriginalBytes;
void PatchFunction() {
for (BYTE *bAddr = Address, DWORD dwCount = 0; dwCount < 5; bAddr++, dwCount++) {
bOriginalBytes[i] = *bAddr;
}
*((BYTE *)Address) = 0xE8; //jmp instruction
*((DWORD *)(Address + 1)) = MakeJmp((Address+1), NewFunction); //I think
}
void FixFunction() {
for (BYTE *bAddr = Address, DWORD dwCount = 0; dwCount < 5; bAddr++, dwCount++) {
*bAddr = bOriginalBytes[i];
}
}
|
|
As lurc already stated, that jmp formula is wrong. Also, 0xE8 the call opcode, 0xE9 is a far jmp. When using MakeJmp, you shouldn't add anything to the address, and that address doesn't need to be a global as it can be passed to the function. Also, you need to use VirtualProtect() first otherwise you will come across access violations. Not to mention there is a lot of superfluous use of variables in your for loops.
See how C# teaches you bad habits?
|
|
| Back to top |
|
|
samuri25404
Grandmaster Cheater
Reputation: 7
Joined: 04 May 2007
Posts: 955
Location: Why do you care?
|
| Posted: Fri Jul 25, 2008 4:22 pm Post subject: |
|
|
| Flyte wrote: | As lurc already stated, that jmp formula is wrong. Also, 0xE8 the call opcode, 0xE9 is a far jmp. When using MakeJmp, you shouldn't add anything to the address, and that address doesn't need to be a global as it can be passed to the function. Also, you need to use VirtualProtect() first otherwise you will come across access violations. Not to mention there is a lot of superfluous use of variables in your for loops.
See how C# teaches you bad habits? |
Yeah, alright. My ASM is rusty. k, haven't used MakeJmp in a long time, didn't quite remember what it was, nor how it was used. The address was just assuming that he was only patching that one function, and it honestly doesn't matter. He could have easily made it dynamic, and I would have done the same had there been the need.
The variables were just personal coding style, and I was throwing it together really quickly, I'm kind of tired anyway, just got back from a long ass movie with some friends (Dark Knight).
As for VirtualProtect(), you've found one thing that's come over from C#... so what? =P
_________________
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
