search

stevemk14ebr / PolyHook_2_0

C++20, x86/x64 Hooking Libary v2.0
MIT License
1.6k stars 226 forks source link

Proposal of hooking empty function (for x86 only) #202

Open wongsyrone opened 3 months ago

wongsyrone commented 3 months ago

To use x86detours, it requires at least 5 bytes to overwrite jmp instruction. What I want to hook is as below:

.text:6A7EB990 vlc_vaLogCallback endp
.text:6A7EB990
.text:6A7EB991 ; ---------------------------------------------------------------------------
.text:6A7EB991                 jmp     short vlc_vaLog
.text:6A7EB991
.text:6A7EB993 ; ---------------------------------------------------------------------------
.text:6A7EB993                 nop
.text:6A7EB994                 nop
.text:6A7EB995                 nop
.text:6A7EB996                 nop
.text:6A7EB997                 nop
.text:6A7EB998 ; START OF FUNCTION CHUNK FOR vlc_vaLog
.text:6A7EB998                 nop
.text:6A7EB999                 nop
.text:6A7EB99A                 nop
.text:6A7EB99B                 nop
.text:6A7EB99C                 nop
.text:6A7EB99D                 nop
.text:6A7EB99E                 nop
.text:6A7EB99F                 nop
.text:6A7EB99F
.text:6A7EB99F ; END OF FUNCTION CHUNK FOR vlc_vaLog
.text:6A7EB9A0 ; Exported entry 727. vlc_vaLog
.text:6A7EB9A0
.text:6A7EB9A0 ; =============== S U B R O U T I N E =======================================
.text:6A7EB9A0
.text:6A7EB9A0
.text:6A7EB9A0 ; void vlc_vaLog()
.text:6A7EB9A0 vlc_vaLog       proc near               ; CODE XREF: vlc_dialog_display_error_va+13B↑p
.text:6A7EB9A0                                         ; vlc_dialog_display_error+13B↑p
.text:6A7EB9A0                                         ; .text:6A7EB991↑j
.text:6A7EB9A0
.text:6A7EB9A0 ; FUNCTION CHUNK AT .text:6A7EB998 SIZE 00000008 BYTES
.text:6A7EB9A0
.text:6A7EB9A0                 rep retn
.text:6A7EB9A0
.text:6A7EB9A0 vlc_vaLog       endp
.text:6A7EB9A0
.text:6A7EB9A0 ; ---------------------------------------------------------------------------
.text:6A7EB9A2                 align 10h
.text:6A7EB9B0 ; Exported entry 425. vlc_Log
.text:6A7EB9B0
.text:6A7EB9B0 ; =============== S U B R O U T I N E =======================================
.text:6A7EB9B0
.text:6A7EB9B0
.text:6A7EB9B0 ; void vlc_Log()
.text:6A7EB9B0                 public vlc_Log
.text:6A7EB9B0 vlc_Log         proc near               ; CODE XREF: libvlc_InternalCleanup+55↑p
.text:6A7EB9B0                                         ; libvlc_InternalInit+110↑p
.text:6A7EB9B0                                         ; libvlc_InternalInit+1F8↑p
.text:6A7EB9B0                                         ; libvlc_InternalInit+90E↑p
.text:6A7EB9B0                                         ; libvlc_InternalInit+9D3↑p
.text:6A7EB9B0                                         ; libvlc_InternalInit+B4E↑p
.text:6A7EB9B0                                         ; config_GetInt+BB↑p
.text:6A7EB9B0                                         ; config_GetFloat+AB↑p
.text:6A7EB9B0                                         ; config_GetPsz+B2↑p
.text:6A7EB9B0                                         ; config_PutPsz+D7↑p
.text:6A7EB9B0                                         ; config_PutInt+10B↑p
.text:6A7EB9B0                                         ; config_PutFloat+109↑p
.text:6A7EB9B0                                         ; config_GetIntChoices+507↑p
.text:6A7EB9B0                                         ; config_ChainParse+365↑p
.text:6A7EB9B0                                         ; config_ChainParse+3E3↑p ...
.text:6A7EB9B0                 rep retn
.text:6A7EB9B0
.text:6A7EB9B0 vlc_Log         endp
.text:6A7EB9B0
.text:6A7EB9B0 ; ---------------------------------------------------------------------------
.text:6A7EB9B2                 align 10h
.text:6A7EB9C0
.text:6A7EB9C0 ; =============== S U B R O U T I N E =======================================

These two functions vlc_Log and vlc_vaLog are left empty intentionally to suppress logging by a closed-source proprietary media player. I cannot compile the official libvlc and libvlccore as the dll contains many crypto constructions I do not know.

Tried plan:

  1. use breakpoint hook: it seems I cannot specify shellcode.
  2. use EAT hook: Although these two functions are exported, direct calls from itself cannot be hooked.

Proposal:

Taking vlc_Log as an example, I want to use the short jump (EB XX) and jump inside the align area, this area is about 0x10 bytes, it's sufficient to put 5 bytes unconditional jump there.

Result:

.text:6A7EB9AB ; ---------------------------------------------------------------------------
.text:6A7EB9AB ; START OF FUNCTION CHUNK FOR vlc_Log
.text:6A7EB9AB
.text:6A7EB9AB locret_6A7EB9AB:                        ; CODE XREF: vlc_Log↓j
.text:6A7EB9AB                 rep retn
.text:6A7EB9AB
.text:6A7EB9AB ; END OF FUNCTION CHUNK FOR vlc_Log
.text:6A7EB9AB ; ---------------------------------------------------------------------------
.text:6A7EB9AD                 db    0
.text:6A7EB9AE                 db    0
.text:6A7EB9AF                 db    0
.text:6A7EB9B0 ; Exported entry 425. vlc_Log
.text:6A7EB9B0
.text:6A7EB9B0 ; =============== S U B R O U T I N E =======================================
.text:6A7EB9B0
.text:6A7EB9B0
.text:6A7EB9B0 ; void vlc_Log()
.text:6A7EB9B0                 public vlc_Log
.text:6A7EB9B0 vlc_Log         proc near               ; CODE XREF: libvlc_InternalCleanup+55↑p
.text:6A7EB9B0                                         ; libvlc_InternalInit+110↑p
.text:6A7EB9B0                                         ; libvlc_InternalInit+1F8↑p
.text:6A7EB9B0                                         ; libvlc_InternalInit+90E↑p
.text:6A7EB9B0                                         ; libvlc_InternalInit+9D3↑p
.text:6A7EB9B0                                         ; libvlc_InternalInit+B4E↑p
.text:6A7EB9B0                                         ; config_GetInt+BB↑p
.text:6A7EB9B0                                         ; config_GetFloat+AB↑p
.text:6A7EB9B0                                         ; config_GetPsz+B2↑p
.text:6A7EB9B0                                         ; config_PutPsz+D7↑p
.text:6A7EB9B0                                         ; config_PutInt+10B↑p
.text:6A7EB9B0                                         ; config_PutFloat+109↑p
.text:6A7EB9B0                                         ; config_GetIntChoices+507↑p
.text:6A7EB9B0                                         ; config_ChainParse+365↑p
.text:6A7EB9B0                                         ; config_ChainParse+3E3↑p ...
.text:6A7EB9B0
.text:6A7EB9B0 ; FUNCTION CHUNK AT .text:6A7EB9AB SIZE 00000002 BYTES
.text:6A7EB9B0
.text:6A7EB9B0                 jmp     short locret_6A7EB9AB
.text:6A7EB9B0
.text:6A7EB9B0 vlc_Log         endp

Question:

Can I hook using x86detour at .text:6A7EB9AB?