开发者

Detours Hook in external process for "empty" function does not work

开发者 https://www.devze.com 2023-03-29 05:35 出处:网络
Im hooking functions in an external process via their function offset. That works well for the functions im hooking so far - however i have found a \"debugLog(char...)\" function that still exist in t

Im hooking functions in an external process via their function offset. That works well for the functions im hooking so far - however i have found a "debugLog(char...)" function that still exist in the binary but doesnt do any printing - it looks like this

debugMessage    proc near               ; 
            xor     eax, eax        ; Logical Exclusive OR
            retn                    ; Return Near from Procedure
debugMessage    endp

it is called like this

push    offset debugString ; "This is a debug message"...
call    debugMessage    ; Call Procedure

Now the debug message has obviously been disabled, i wanted to hook into this as i was开发者_JAVA技巧 able to simply hook into similar func(char..) in the binary already.

This is the code:

typedef void (__stdcall* DebugLog)(const char*);
DebugLog Real_DebugLog = (DebugLog)(0xCAFEBABE);

extern "C"
 {
 static void __stdcall Hook_DebugLog(const char*);
 }

void __stdcall Hook_DebugLog(const char* text) {
MessageBox(NULL, text, "MyDebugLog", MB_OK);
return Real_DebugLog(text);
}

// in dll main attach..
DetourTransactionBegin(); 
DetourUpdateThread(GetCurrentThread()); 
DetourAttach(&(PVOID&)Real_DebugLog, (PVOID)Hook_DebugLog); 

A similar approach works for all other functions i have so far hooked into this binary. I also made sure the debugMessage is even called with a debugger.

Any ideas why this hook is not working at all? Maybe because the function could have var args? i already tried with const char*,...).


A "detour" requires a minimum of 5 bytes to work (x86) - debugMessage is only 3 bytes.


The function is likely too small to hook. Detours has to overwrite a potion of the hooked function to redirect calls elsewhere, but there probably isn't enough room in that logging stub for Detours to write a JMP instruction targeted at your replacement.

0

精彩评论

暂无评论...
验证码 换一张
取 消