Im hooking functions in an external process via their function offset. That works well for the functions im hooking so far - however i have found a "debugLog(char...)" function that still exist in the binary but doesnt do any printing - it looks like this
debugMessage proc near ;
xor eax, eax ; Logical Exclusive OR
retn ; Return Near from Procedure
debugMessage endp
it is called like this
push offset debugString ; "This is a debug message"...
call debugMessage ; Call Procedure
Now the debug message has obviously been disabled, i wanted to hook into this as i was开发者_JAVA技巧 able to simply hook into similar func(char..) in the binary already.
This is the code:
typedef void (__stdcall* DebugLog)(const char*);
DebugLog Real_DebugLog = (DebugLog)(0xCAFEBABE);
extern "C"
{
static void __stdcall Hook_DebugLog(const char*);
}
void __stdcall Hook_DebugLog(const char* text) {
MessageBox(NULL, text, "MyDebugLog", MB_OK);
return Real_DebugLog(text);
}
// in dll main attach..
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach(&(PVOID&)Real_DebugLog, (PVOID)Hook_DebugLog);
A similar approach works for all other functions i have so far hooked into this binary. I also made sure the debugMessage is even called with a debugger.
Any ideas why this hook is not working at all? Maybe because the function could have var args? i already tried with const char*,...).
A "detour" requires a minimum of 5 bytes to work (x86) - debugMessage
is only 3 bytes.
The function is likely too small to hook. Detours has to overwrite a potion of the hooked function to redirect calls elsewhere, but there probably isn't enough room in that logging stub for Detours to write a JMP instruction targeted at your replacement.
精彩评论