如何找到一个函数地址钩/绕路的EXE文件？ [英] How to find a functions address to hook/detour in an EXE file?

问题描述

我又开车撞墙并且需要一些低层次的东西你的帮助。我已经成功地钩住导出的DLL函数（与这code BTW。）通过注射到我的目标过程（如我可以轻松地绕道 MessageBoxW 从 user32.dll中）。不幸的是我的目标了不同的情景：我有绕路可执行文件中定义的功能我在我的注入code到。该应用程序是开源的，所以我知道我需要为它挂接函数的一切，但二进制文件与证书签名的，所以我不能编译我自己的版本。是否有可能在运行时获取函数的地址，或与另一种技术舍近求远呢？目标是一个正常的32位的Windows二进制BTW。没有什么特别的我想;）

I drove against a wall again and need your help with some low-level stuff. I already succeeded in hooking exported DLL-Functions (with this code btw.) by injecting them into my target process (e.g. I can easily detour MessageBoxW from user32.dll). Unfortunately I aim for a different scenario: I have to detour a function defined inside the executable I'm injecting my code into. The application is Open-Source so I know everything about the function I'd need for hooking it, but the binary is signed with a certificate so I can not compile my own version. Is it possible to fetch the functions' address at runtime or detour it with another technique? The target is a "normal" 32bit Windows binary btw. nothing special I thought ;)

你的，
Nefarius

Yours, Nefarius

编辑：可能是由于我的英语跛脚我不够详细，所以这里一个小样本code：

maybe due to my lame English I was not detailed enough, so here a little sample code:

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd )
{
    foo();
}

BOOL foo(char* someData)
{
    return printf("%s", someData);
}

现在我想绕路功能富（），它并不在一个动态库中。这是我的问题。我不知道我怎么和我不知道，如果这个工程就像我认为它。

Now I want to detour the function foo() which does not exist in a dynamic library. This is my problem. I don't know how and I'm not sure if this works like I think it does.

编辑：现在我知道这是可能的，所以重要的问题变成：怎么了？我如何获得我需要的信息;函数地址？

Now I know it is possible, so the important question changed to: how? How do I get the information I need; the functions address?

推荐答案

我获得了我的目标与挂钩一些低级别的Windows API函数，不是最好的解决方案，但它的工作原理，汇编是不是我的......

I acquired my aim with hooking some low-level Windows API functions, not the best solution but it works, Assembler isn't mine...

这篇关于如何找到一个函数地址钩/绕路的EXE文件？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！