Hook unexported functions

[djn3m0]

Hello,

I need to hook a function inside a .exe file, there is no symbol that I can resolve or it's not exported like in .dlls. What is the right way of hooking unexported functions inside a .exe file?

I would appreciate if you can point me to any code or sample.

Thanks

[sylveon]

You need to use something else to find the address, for example the DIA API with PDB symbols, or hardcoding a raw offset, etc.

Then once you have a function pointer, you should be able to use Detours as usual.

[djn3m0]

I'm not familiar with DIA Api and googling brings up some unrelated stuff, can you please provide link or some documentation?

thanks

[ptrstr]

You can also use a tool like Ghidra or IDA to find the address of the function you want to hook.

You can then:

• Subtract that address with the load address Ghidra/IDA sets (this gives you the offset)
• Find the base address of the loaded executable (You can use GetModuleHandleA)
• Add that offset to the base address of the loaded executable. You now have the address of the function to hook.

[sylveon]

Yes, that would be hardcoding a raw offset

[djn3m0]

Thanks it was very helpful