function hooks

[gokickrocks]

At my work we have a third party software that we would like to modify to better suit our production needs.

I searched through the third party's DLL and found the function that applies to what we need to modify.

Not sure if its even function hooks I want to deal with...
I basically want to modify a functions parameters or if it is possible, just modify the array which the function gets values from.

Anyone know how to do this? or can point me in the right direction in regards to literature?

 

[Frank]

Not enough info.

My recommendation: find a better library.

 

[gokickrocks]

In the third party software (where I do not have access to the source code), there is a function that returns an int array but I would like to change the values of it.

 

[pcchen]

You mean you want to modify the function of the dll?
A possible way to do this is to write a new dll which has all the functions of the old dll, but for all other functions you don't want to modify, you just all the old dll. And for the function you want to modify, just call the old dll and modify the outcome. For example, suppose the old dll is called hello.dll, then you rename it to hello2.dll, and created a new hello.dll with the same interface (all the functions), and inside your new hello.dll, you load and call hello2.dll.

 

[gokickrocks]

And for the function you want to modify, just call the old dll and modify the outcome.

Coudl you expand on this more?...how do I go about modifying the outcome?

 

[pcchen]

Coudl you expand on this more?...how do I go about modifying the outcome?

It's sort of like a wrapper. Suppose that a function called "compute" in hello.dll (which is renamed to hello2.dll) which accepts two input and returns the sum of the two numbers. You want to modify it to add one to the result. So you make your own hello.dll with the "compute" function which also takes two inputs, and you call the "compute" function in hello2.dll, add one to the result, and return it.

 

[chavvdarrr]

mmmmmm, some months ago I was browsing a microsoft site for... research, and there was program which was claimed to do exactly that type of things e.g. hook to a function in a dll and write your own replacing it.... wish i remember the url...


PS: http://research.microsoft.com/research/downloads/default.aspx
or go directly to http://research.microsoft.com/sn/detours/

Detours is a library for intercepting arbitrary Win32 binary functions on x86 machines. Interception code is applied dynamically at runtime. Detours replaces the first few instructions of the target function with an unconditional jump to the user-provided detour function. Instructions from the target function are placed in a trampoline. The address of the trampoline is placed in a target pointer. The detour function can either replace the target function or extend its semantics by invoking the target function as a subroutine through the target pointer to the trampoline. Detours are inserted at execution time. The code of the target function is modified in memory, not on disk, thus enabling interception of binary functions at a fine granularity. For example, the procedures in a DLL can be detoured in one execution of an application, while the original procedures are not detoured in another execution running at the same time. Unlike DLL re-linking or static redirection, the interception techniques used in the Detours library are guaranteed to work regardless of the method used by application or system code to locate the target function. In addition to basic detour functionality, Detours also includes functions to edit the DLL import table of any binary, to attach arbitrary data segments to existing binaries, and to inject a DLL into a new or existing process. Once injected into a process, the instrumentation DLL can detour any function in the process, whether in the application or the system libraries, such as Windows APIs. The package includes the complete source code to the Detours Package, more than 20 samples using detours, and documentation. A commercial license for Detours is available upon request. To inquire about acquiring a commercial license to the Detours Package, e-mail Microsoft's Intellectual Property and Licensing Group, at iplg@microsoft.com. Please include the text “DETOURS LICENSE REQUEST” in the subject line.

Hope it helps

 

[gokickrocks]

Thanks for all the help