Hooking Any Function
Description about hooking options in HyperDbg
Hooking is a powerful feature of HyperDbg. You can hook all user-mode and kernel-mode functions and expect a fast in-line hook or unlimited EPT hooks.
Assume that
ExAllocatePoolWithTag
is located at fffff805`5cdb2030
.PVOID ExAllocatePoolWithTag(
__drv_strictTypeMatch(__drv_typeExpr)POOL_TYPE PoolType,
SIZE_T NumberOfBytes,
ULONG Tag
);
Another thing is that the above function is called with Fastcall calling convention, and the parameters are passed in the following order
rcx
, rdx
, r8
, r9
, and the rest of them are located on the stack. So, we have two options here to create a log from the parameters of this function. For example, we want to create a log from the Tags which is on r8
.HyperDbg> !epthook fffff805`5cdb2030 script { print(@r8); }
If we want to use !epthook2, then the following command is used :
HyperDbg> !epthook2 fffff805`5cdb2030 script { print(@r8); }
Last modified 1yr ago