x86 API Hooking Demystified (2012)

Re:x86 API Hooking Demystified (2012) by djmips on Wednesday July 10, 2019 @06:54AM (#20400767)

Renderdoc uses hooking to instrument your 3D API calls to provide excellent graphics debugging. Good example to dive into since it's also cross platform.

https://github.com/baldurk/renderdoc

I used graphics API hooking in a Source Engine game where I didn't have the source for the engine but needed to display the 2D Flash based GUI (Iggy) at the correct time. It was fun to get it working.

Valve's Steam also does something similar since it has the ability to superimpose it's GUI over a running game.

[ Parent | on HN ]

Re:x86 API Hooking Demystified (2012) by Const-me on Wednesday July 10, 2019 @09:24AM (#20401692)

Conceptually yes, but technically renderdoc works differently. On Windows it patches IAT (Import Address Table), then for D3D it wraps complete D3D COM interfaces. It doesn’t use the described tricks to patch code with jmp instruction, it’s not too reliable, IMO.

Similar on Linux, it doesn’t have IAT but it has PLT (Procedure Linkage Table) which is basically the same thing as IAT.

[ Parent | on HN ]