News for hackers. Stuff that matters.

A comment on Google XRay: A Function Call Tracing System [pdf].

Re:Google XRay: A Function Call Tracing System [pdf] by wslh on Monday May 02, 2016 @05:22PM (#11615774)
I am never tired of this shameless plug: our state of the art open source instrumentation engines for Microsoft Windows where you can hook applications without even knowing about the complexities of hooking. The most programmer friendly is https://github.com/nektra/Deviare2 while the Microsoft Detours competitor is: https://github.com/nektra/Deviare-InProc

It has an embedded disassembler to smartly hook functions even if they have a jmp in the prologue.

[ Parent | on HN ]
Re:Google XRay: A Function Call Tracing System [pdf] by 05 on Monday May 02, 2016 @06:22PM (#11616201)
Yeah but what if they have a branch target in the prologue?
[ Parent | on HN ]
Re:Google XRay: A Function Call Tracing System [pdf] by mxmauro on Tuesday May 03, 2016 @06:44AM (#11619402)
When the stub for calling the original function is created, most hooking engines assumes the prologue contains the standard "mov edi,edi/push ebp/mov ebp,esp" and it is wrong.

If the prologue contains, for e.g., a relative jmp, copying opcodes is not enough. You must convert it to an absolute jump in the generated stub. The same applies to several instructions doing relative/indirect addressing.

[ Parent | on HN ]
Re:Google XRay: A Function Call Tracing System [pdf] by Keyframe on Monday May 02, 2016 @06:38PM (#11616315)
Yes.
[ Parent | on HN ]