Jump to content
Tuts 4 You

Any api hook library ?


White

Recommended Posts

Hi,guys


 


Do you know any hook api library with its open source code ?


 


I have tried mhook library,not quiet good with named 'RtlAllocateHeap' api.


 


So I am wandering if you guys may know some better library that I can use it to hook that api.


Currently I am re-coding a plugin,you may see it within Christmas :)


 


 


Thanks in advance.


Link to comment

Hi, atom0s


 


 


Detours library use RtlAllocateheap api to allocate memory for a temp bridge to get orignal command for its hook routine. So it may cause stack overflow.


 


ihook use malloc api to allocate,so it is the same situation as RtlAllocateheap do.


 


Hope that minhook and ncodehook will be different.   :)


Thanks for your reply.

Link to comment

@atom0s


em,currently I use VirtualAlloc to allocate a larger enough memory,write some self code for a temp use. not quiet perfect but good .


 


@Aguila


 


'0xE9 jmp' is not well for those special target,re-redirection command.I use '0x68' and '0xC3' for a temp hook.


Thanks for your pieces of code, got some better overview.


Link to comment

@evlncrn8


em, FF25 is very nice for my case,


 


@Aguila


yes, re-redirection is annoying part of its anti dump. For its second  redirection command,it use memcpy api to copy the opcode.


So if I use jmp code, it may point to somewhere unknown.That's the most bad thing of it.

Link to comment

In most cases anti-cheats / anti-tampers and such will check at least the first 5-6 bytes of an API to determine if its been altered. Since most API start with the same stub of:


mov EDI, EDI,


push EBP


mov EBP, ESP


 


That being said, sometimes you will need to do a mid-function hook instead to bypass the checks. Unless of course they take snapshots of the full API and its branches and do comparisons that way.


It depends on how thorough the detections are.


Link to comment

@atoms


this situation happens after its all check thread started.


My point is hook that api before all that thread.So that will not happen in my case.


The code will restore all hooked api when some special routine done.

Link to comment
  • 1 year later...

@atom0s The free version has many limitations, Even the 32-bit version is limited.

Quote

Detours Express 3.0 is available for immediate download under a no-fee, click-through license for research, non-commercial, and non-production use.  Detours Express is limited to 32-bit processes on x86 processors.

 

Link to comment
1 minute ago, Perplex said:

@atom0s The free version has many limitations, Even the 32-bit version is limited.

 

For me, it fits my needs. I don't really do much with 64bit targets so it is not a concern of mine.

  • Like 1
Link to comment

Usually I use hardware breakpoints in my injected libraries. Memory breakpoints also work but I never implemented it. Obviously this doesn't work if your target screws with hardware breakpoints. You can also place an int3 byte and do things that way.

https://bitbucket.org/mrexodia/enigmahwid/src/b3eeee1772c369b1a37b7dfa68d5a4b7d9589ec0/main.cpp?at=master&fileviewer=file-view-default

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...