#Function hooking convention

10 messages · Page 1 of 1 (latest)

frail parrot
#

Maybe convention isn't the right word, but was curious what the easiest or "standard" way to hook functions is when writing full code mods. In the past I've just done simple execute-before or execute-after's, or for simple mid function hooks I've just been writing the patch directly in assembly but that would be a major pain in the ass for more complicated behavior.

In the case of more complicated function hooks, would the best way be to just essentially copy the whole function (maybe using the decompiler-generated pseudocode as a base?) and then editing the necessary components, or is there a better way to do it?

Don't really have much experience in function hooking in this capacity so any advice would be appreciated :)

shell garden
#

usually pre or post hooks are fine, if you need to modify the function then you have to map out all the structs used by the function and pray Ghidra/IDA somehow havent destroyed the pseudocode

#

sometimes they even get the types or arguments from a function wrong

frail parrot
#

yeah i've used pre/post/asm hooks already but modifying the function itself seems rough, especially if it relies on the ghidra pseudocode output

#

lol yeah ive noticed that, changed a few in my project file already

#

so it just comes down to starting with the pseudocode, make modifications, pray ghidra didn't mangle it?

shell garden
#

the praying part is important

frail parrot
#

persona modding gonna make me a religious man

#

thanks DC, gonna mess with it a bit and see how it goes