Hotpatching a C Function on x86

Re:Hotpatching a C Function on x86 by wslh on Friday April 01, 2016 @07:29AM (#11404072)

Shameless plug but my company is almost wholly oriented to binary intrumentation!

In our Deviare Hooking Engine/Deviare In Process [gihub-1] and RemoteBridge [github-2], we have a disassembler in place to hook Win32/COM/C++ vtables, so the hooking process is smarter if there are changes in the prologue. You can obviously take a look at the source code and learn a lot from it since it is state of art and perfectly competing with Microsoft Detours [3]. For an old comparison with Microsoft Detours you can check [4].

For anyone else looking for an extremely easy to use and higher level API, Deviare Hooking Engine makes extremely easy to hook and handle functions parameters and return value. Simple like this:

[snippet]

            notepadPID = LaunchNotepadAndGetPid();

            //in first place, hook DllGetClassObject of the target dll/ocx
            hookDllGetClassObj = spyMgr.CreateHook("shell32.dll!DllGetClassObject", (int)eNktHookFlags.flgOnlyPostCall);
            hookDllGetClassObj.Attach(notepadPID, true);
            hookDllGetClassObj.Hook(true);
            hookDllGetClassObj.OnFunctionCalled += OnDllGetClassObjectCalled;

[/snippet]

Docs are available here: http://www.nektra.com/products/deviare-api-hook-windows/doc-...

[github-1] https://github.com/nektra/Deviare2

[github-1 bis] https://github.com/nektra/Deviare-InProc

[github-2] https://github.com/nektra/RemoteBridge

[3] http://research.microsoft.com/en-us/projects/detours/

[4] https://www.reddit.com/r/programming/comments/22crn0/gpl_alt...

[ Parent | on HN ]

Re:Hotpatching a C Function on x86 by dreamlayers on Friday April 01, 2016 @11:59AM (#11405780)

Yes, while it's nice to learn about this, it's a lot more practical to use a library like that. Thanks for releasing your library as open source with a GPL license.

If I want to use it with the GPL license, that only means my own code using your library needs to have a GPL compatible license, right? I can use your library with my GPL compatible code to modify other closed-source or GPL-incompatible code, right? Just checking because some may view it as using a GPL plugin with GPL-incompatible program, which violates the GPL.

[ Parent | on HN ]

Re:Hotpatching a C Function on x86 by wslh on Friday April 01, 2016 @12:42PM (#11406250)

If I understand well you want to use Deviare in your GPL compatible project and hooking into a closed source application such as Microsoft Outlook, Internet Explorer, Skype, etc? The answer is yes, you can use Deviare in this context using the GPL license, we don't think that instrumenting a closed-source application via Deviare is part of your software, even when you can complement other closed-source applications.

[ Parent | on HN ]