How to hook the end of a function

[MillionSky]

Currently, we can hook the begin of a function。How to hook the end of a function? So that we can check the return value of the function, or execute some code after the function end.

[lunixbochs]

You can hook any address.

[MillionSky]

You can hook any address. Oh, Thanks very much!

[MillionSky]

So, if the function have multi ret point, we must hook every address.

[MillionSky]

I encountered a problem when hook the end of a function. The hook seems have side effect. The original instructions before hook: .text:08049A18 5B pop ebx .text:08049A19 5E pop esi .text:08049A1A 5F pop edi .text:08049A1B 5D pop ebp .text:08049A1C C3 retn .text:08049A1C TargetFunc endp .text:08049A1C .text:08049A1D .text:08049A1D ; =============== S U B R O U T I N E ============ .text:08049A1D .text:08049A1D ; Attributes: bp-based frame .text:08049A1D .text:08049A1D ; int __cdecl main(int argc, const char argv, const char envp) .text:08049A1D public main .text:08049A1D main proc near ; DATA XREF: _start+17 .text:08049A1D 8D 4C 24 04 lea ecx, [esp+4] .text:08049A21 83 E4 F0 and esp, 0FFFFFFF0h .text:08049A24 FF 71 FC push dword ptr [ecx-4] .text:08049A27 55 push ebp .text:08049A28 89 E5 mov ebp, esp

After hook, the begin of main function was modified: .text:08049A18 5B pop ebx .text:08049A19 5E pop esi .text:08049A1A 5F pop edi .text:08049A1B 5D pop ebp .text:08049A1B TargetFunc endp ; sp-analysis failed .text:08049A1C E9 db 0E9h .text:08049A1D .text:08049A1D ; =============== S U B R O U T I N E ============== .text:08049A1D .text:08049A1D .text:08049A1D ; int __cdecl main(int argc, const char argv, const char envp) .text:08049A1D public main .text:08049A1D main proc near ; DATA XREF: _start+17 .text:08049A1D 72 B6 jb short loc_80499D5 .text:08049A1F 02 00 add al, [eax] .text:08049A21 83 E4 F0 and esp, 0FFFFFFF0h .text:08049A24 FF 71 FC push dword ptr [ecx-4] .text:08049A27 55 push ebp .text:08049A28 89 E5 mov ebp, esp

We can discover that ret instruction(C3) and following 4 bytes in main was modified to "e9 72 B6 02 00"。As the result, the program failed to start.

[lunixbochs]

You shouldn’t hook the ret, you should hook a few bytes before. You can also pt.inject your asm and patch in a jump instead of using hook.

[lunixbochs]

Use the -v flag to see exactly what patchkit changed.

[MillionSky]

OK，I understand. Thanks very much!