Solved DetourFunc Problem

[m0v]

hey guys i tryed today to make a simple messagebox detourfunc hook for a sample but it still wont work maybe some one of you can get me through what i did wrong here comes the code

#include "detours.h"
#pragma comment(lib, "detours.lib")

int (__stdcall* InsertDateTime)(int x); //Function prototype

int MyInsertDateTime(int x) //Our function
{
//Messagebox
MessageBoxA(NULL, "InsertDateTime Just Got Called", "InsertDateTime", MB_OK);
return InsertDateTime(x); //Return the origional function
}

BOOL APIENTRY DllMain( HMODULE hModule,
            DWORD ul_reason_for_call,
            LPVOID lpReserved
					 )
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		InsertDateTime = (int (__stdcall*)(int))DetourFunction((PBYTE)0x0100978A, (PBYTE)MyInsertDateTime);
		Beep(1000,1000);
		break;
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		DetourRemove((PBYTE)0x0100978A, (PBYTE)InsertDateTime);
		break;
	}
	return TRUE;
}

forget to say that i use Detour 1.5 and the lib

 

[voidisalive]

Here mate read on this topic on Wikipedia https://en.wikipedia.org/wiki/Address_space_layout_randomization

thats the security Notepad has on win 7 and vista too I think Xp doesn't have this and to work around that you have to use Relative virtual Address not Virtual Adressess to get your relative virtual address all you need to do is take the address of the function in IDA, subtract the base address that IDA is using, and you'll have your relative virtual address. then use the runtime base address + rva using GetModuleHandle
like this

GetModuleHandleA("notepad.exe")) + 0x978A;

Result

and here is the source

#include <windows.h>
#include <detours.h>

//Original Function
typedef int (__stdcall* InsertDateTime_o)(int x); 
InsertDateTime_o InsertDateTime;	
//Function to detour
int DateAndTime(int x)
{
	MessageBox(NULL, "Time and Date has been Detoured!!!", "voidisalive", 0x00000000L);
	return InsertDateTime(x);
}

int WINAPI DllMain(HMODULE hModule, DWORD Reason, LPVOID lpReserved)
{
	if( DLL_PROCESS_ATTACH == Reason )
	{
		//typecast reinterpretention DWORD cast.
		DWORD dwNP = reinterpret_cast<DWORD>(GetModuleHandleA("notepad.exe")) + 0x978A;//Runtime Base + RVA
		InsertDateTime = reinterpret_cast<InsertDateTime_o>(DetourFunction((PBYTE)dwNP, (PBYTE)&DateAndTime));
	}
		
	return true;
}

Download -> https://www.4shared.com/rar/xv8EgdZx/DetourTimeDateCpp.html
Virus scan -> https://virusscan.jotti.org/en/scanresult/490b94a38d2d947d14b79c6cb666183dbe69d30f

Greets,

voidisalive

 

[voidisalive]

Hey Mov take a look at my video here

Detouring Minesweeper IDA , C++, detours

shows you how to detour a function with yours.

Greets,

voidisalive

 

[m0v]

thanks for that voidisalive i hope it helps me out to get it

 

[voidisalive]

No problem let me know if the info on the video helped you.

Greets,

voidisalive

 

[m0v]

didnt worked well i dont know what i did wrong winject always says:

Both injections-methods faild!

(RemoteLoadLibrary and Detourinjecting)
Target is protected? err: 0

 

[voidisalive]

then try another injector... I'm sure it will work just fine.

Greets,

voidisalive

 

[m0v]

I tryed another injector and it comes to the same error always no found library should I put it in the source like #pragmatic once (lib,"detours.lib") or wouldn't it help?