[Thr]

Part II of this thread can be found at: http://www.discussionzone.net/showthread.php?tid=8169

Recently, I've been getting into hooking functions with C and C++, and I would like to share some of my knowledge of it.

First of all, what is a hook?
Well a hook is a simple override on something. For instance, when you hook a function, you're making an override on that function and mapping it to your own function. This can be as simple as hooking a math function or hooking a winsock application and overriding connects and sends.

Today, we will be writing a simple application in C to hook a function called "realfunc" and mapping it to a function called "hookedfunc".

This tutorial should take 20-30 minutes depending on how well you are at following instructions

If you don't already have Detours, go get it here:
http://research.microsoft.com/en-us/projects/detours/

The free edition is limited to hooking functions in x86 (32-bit processes) only. You'll also need to compile Detours. To do so, you'll need to open a command prompt that is running with administrative privileges.

Paste the following into a command prompt:

Spoiler:

32-Bit OS (x86):

Code:

"C:\Program Files\Microsoft Visual Studio 10.0\VC\vcvarsall.bat" cd "C:\Program Files\Microsoft Research\Detours*" nmake

64-Bit OS (x64):

Code:

"C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\vcvarsall.bat" cd "C:\Program Files (x86)\Microsoft Research\Detours*" nmake

You'll then need to copy some files to include them inside of your Visual Studio 2012 project.

Open up the Detours Folder (<ProgramFiles>\Microsoft Research\Detours*) and copy all of the items in the "includes" folder into "<ProgramFiles>\Microsoft Visual Studio 11.0\VC\includes".
You'll also need to copy the libs.X86 folder over (rename it to libs first, and then merge the folder into the VC folder).

Now, time to have some fun.

Open Visual Studio and create a new C++ project.



A window should open, press next and make sure your project looks like mine:



You'll get a nice new project with a .cpp file that looks exactly like this:



Now, you'll need to create two functions. They'll both return nothing and require an integer as the parameter.



Let's make those functions have some functionality.



Now we shall initialize our Detours hook!

Code:

#include <Windows.h> #include <detours.h>

Go to Project->Properties->Linker->Input
Press the little arrow under Additional Dependencies and press edit.
Add the following:



Now, we'll need to get the address of our "RealFunc" function.

Code:

void (*realfunction)(int) = RealFunc;

Spoiler:

Now, we shall start our Detours hook.



Basically, we are attaching Detours to the address of the "RealFunc" function by passing along the pointer of our function in DetourAttach().
It then points to the address of "HookedFunc".

Let's try and run it!



We did it! We called RealFunc() before the hook, and then we called it after the hook! It successfully hooked!

Now, we have to write a method to unhook it just in case we want to restore the original function.

Add this before that last getchar() call:



Let's try to run this again!



Congratulations! You have successfully hooked a function! You can now apply this to common functions in the Windows API and combining that with DLL injection, you can change the functionality of certain programs.

I hope you enjoyed my tutorial! This took me around 20-minutes to write. Stay tuned for more!

I have included a copy of the project (Source + Binary):
http://www.mediafire.com/download/a8qvnu...ation1.zip
The password is "THR_DZ.NET-DET_TUT".

[0x4b33]

This is just amazing. I learned so much from reading this. Thanks bro.

[Thr]

This is just amazing. I learned so much from reading this. Thanks bro.

I'm glad I could help
Part II will be posted later today or tomorrow. It will be about DLL injection and hooking functions in injected processes.

[Exiled]

Holy fuck balls. Good work, Thr. I'm really impressed.

[Thr]

Holy fuck balls. Good work, Thr. I'm really impressed.

Thanks :3

It was a lot of fun writing that

[Exiled]

Holy fuck balls. Good work, Thr. I'm really impressed.

Thanks :3

It was a lot of fun writing that

I'm sure you did, looks very neat and sleek.

[Thr]

Holy fuck balls. Good work, Thr. I'm really impressed.

Thanks :3

It was a lot of fun writing that

I'm sure you did, looks very neat and sleek.

Haha thanks I'm in the process of writing part II right now.

[Exiled]

Thanks :3

It was a lot of fun writing that

I'm sure you did, looks very neat and sleek.

Haha thanks I'm in the process of writing part II right now.

Can't wait to see it! Best of luck creating it.