| View previous topic :: View next topic |
| Author |
Message |
Slugsnack
Grandmaster Cheater Supreme
![]() Reputation: 71
Joined: 24 Jan 2007
Posts: 1857
|
 Posted: Sun Jun 07, 2009 6:09 am Post subject: IAT Hook |
 |
|
so i wanna place IAT hooks on every single module of a given executable. so.. let's say i wanna hook MessageBoxA, this was my idea.
1) GetProcAddress() on MessageBoxA
2) Traverse module list with CreateToolhelp32Snapshot(), Module32First()/Module32Next()
3) Use modBaseAddr to PE header >> read offset to PE signature >> fetch IAT address + IAT size
4) Walk IAT checking each entry for whether it matches the return from GetProcAddress(), if yes, redirect to hook function then move to next module
my questions..
1) is there a way to distinguish from system modules and user code ? that would save walking the IATs (if existent) of unnecessary modules
2) is there a better way to find the entry of the function to be hooked ? i am thinking something like.. import table
|
|
| Back to top |
|
 |
tombana
Master Cheater
![]() Reputation: 2
Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
|
| Posted: Sun Jun 07, 2009 7:44 am Post subject: Re: IAT Hook |
|
|
| Slugsnack wrote: | my questions..
1) is there a way to distinguish from system modules and user code ? that would save walking the IATs (if existent) of unnecessary modules
2) is there a better way to find the entry of the function to be hooked ? i am thinking something like.. import table |
1) Maybe you could check it's version information and check whether the company name is Microsoft or something like that, or check for a digital signature. But remember that a user module might call a system module which then calls the MessageBox, so in that case you will have to hook every module.
2) I think GetProcAddress will be the best since it will do the same as you will do when you write the function yourself (walk the export table of user32)
|
|
| Back to top |
|
|
Slugsnack
Grandmaster Cheater Supreme
![]() Reputation: 71
Joined: 24 Jan 2007
Posts: 1857
|
| Posted: Sun Jun 07, 2009 9:09 am Post subject: |
|
|
q1.. now you bring up that point maybe it is smarter to walk all modules, there isn't a massive overhead anyway
q2.. i think you might have misunderstood my question. i mean is there a better way to find the entry within the IAT rather than walking and testing each entry. although now i think about it i don't think there is a better way
gonna do some coding tonight and test it out
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
