CODEWITHSUNDEEP
c++assemblyhookreverse-engineering
lua
lua

Reputation: 43

How to hook C++ functions with asm

I want to hook a C++ function. But I don't want to use the trampoline mechanism of ms detours, instead of it I want to fully patch it. I can get the handle to the DLL, where the function is located and I have the right offset(imageBase stuff ...). So how to hook it? And I don't know the data types of the arguments(var_4 and arg_0), or aren't they needed? In general I want to replace following function with my own one(my function is nearly the same, there's only a line changed):

sub_39001A40    proc near

    var_4       = dword ptr -4
    arg_0       = dword ptr  4
        push    ecx
        cmp dword_392ADAB4, 0
        jnz short loc_39001A4F
        call    loc_39024840

loc_39001A4F:
        push    esi
        mov esi, [esp+8+arg_0]
        lea eax, [esp+8+var_4]
        push    eax
        push    esi
        call    dword_392ADA98
        mov ecx, [esp+10h+var_4]
        add esp, 8
        add dword_392ADA80, ecx
        adc dword_392ADA84, 0
        add dword_392ADA90, esi
        pop esi
        adc dword_392ADA94, 0
        add dword_392ADA7C, 1
        pop ecx
        retn
sub_39001A40    endp

It's bad, that I only can hook functions, which names I know with ms detours. I cannot hook those asm functions with detours, cause I need the data types of the arguments passed for creating the function structures!

EDIT::::

"What's wrong with detours, exactly?"

I wrote: "I don't want to use the trampoline mechanism of ms detours, instead of it I want to fully patch it." and "It's bad, that I only can hook functions, which names I know with ms detours. I cannot hook those asm functions with detours, cause I need the data types of the arguments passed for creating the function structures!" and I don't have the source code of the C++ files. I only have the hex-dump.

"Trampoline is an actual technical term :) I'm just wondering why @lua can't use it."

I write: Read my sentences again, if you still don't understand why, my english is bad.

"Overriding just the named function should work, of course you may need to re-implement the whole DLL (depending on if it is of any further use to you). Given your grasp of assembler you might get away with using a hex editor to edit (a copy of) the original DLL you are seeking to subvert."

I want to hook the function, because I don't want to edit the file. I can't overwrite my function, because I don't know the datatypes of the arguments and the function's name.

@asveikau: Thanks for your real help, but I don't want to use a trampoline mechanism, I want to overwrite the function.

Upvotes: 3

Views: 4854

Answers (2)

asveikau
asveikau

Reputation: 40226

A good trick is to replace the first few instructions with this:

push dword xxxx ; where xxx = new code location
ret

This is sort of like an obfuscated jmp. I write it this way because the assembled version of this is very easy to replace the push operand with your pointer at runtime. It assembles to:

68 XX XX XX XX c3

Where "XX XX XX XX" is your address in little-endian.

Then you can make a "call the old version of the function" code location, where the first few instructions are the ones you replaced with the sequence above, followed by a jump to the next valid instruction in the original code.

Upvotes: 1

John
John

Reputation: 6648

Overriding just the named function should work, of course you may need to re-implement the whole DLL (depending on if it is of any further use to you). Given your grasp of assembler you might get away with using a hex editor to edit (a copy of) the original DLL you are seeking to subvert.

Upvotes: 0

Related Questions