So in this video, we'll be taking a look at the simple API hooking in C-sharp.
So this is the function we have.
Let's say this one has the normal function and every function starts with this function product.
So this is the x3x come x creating the x register and then setting up the stack frame.
So we are pushing the previous functions based pointer under the stack and then copying the DSP value
into the EVP.
So that KB points to this latest value on the stack and also espresso also related to the stack.
Now the stack gets increased.
So this is the basic function product that happens on the stack whenever the new function is about to
be called.
So this occupies five bytes.
Now what we're going to do is we are going to all write these bytes with the jump instruction.
So.
With a jump instruction to my custom function.
And this custom function is called who could function.
So in this custom function.
This will be calculating the offset between these two function addresses.
And then we are going to jump with this offset and then the program execution goes to this function.
Now the program gets started executing it here.
Now we are going to rewrite these bytes back to this function.
So we will be saving this these bytes in an area.
And after the program education got into this or who could function.
We will then immediately write these bytes into this function so that this function will be a varied
one, so that these function parameters will be passed around to this function.
So we can examine the function parameters and do whatever the operation we want.
So this is similar to the back during our executables where we write the entry point to the code and
then sell registers and execute the shared code, then pop back the registers and then continue jump
back to this instruction or general entry point.
So that is what we do.
We have seen in the back during executables.
This is also similar to that already, but except instead of saving or the general purpose and E flags
will be saving these five bytes, we will be saving these five bytes in an array and then we will write
the OP code of this offset.
So whenever a function is called the program, execution goes from this point to my custom function
to our custom function here immediately will be copy will be restoring these bytes at this address because
this function should execute like legally.
So all these parameters will be passed down to this function and we can examine the parameters and do
particular operation based on those parameters.
So let's see here we are going to use the message box.
So we are now the message box.
I think we no need of this one actually defining.
I'm I wrote here just to show you the syntax of this first one is the handle and second one is text
and the caption and the type of the message box.
So so message box is the user that you should adhere to.
So we need to.
Road user 32 dot.
So after voting we will get handle User 32 handle.
And we are going to find the address of message box here so we can use get address of user 32 handle
and.
My search box here.
So let's call this jazz funk address.
So this is the actual original function address.
So we have found the address of message box.
Now we are going to save the first five bytes.
Of this function at this address.
So let's declare a budgetary which is saved by new battery of five, five and.
Now we need to copy these five bytes.
Marcia, Dot copy.
And.
You can see function address.
Copy from that address.
Into the destination area.
Car saved bytes and starting index zero from where you want to copy and then rent this file.
You can also put saved by rent to make this flexible.
So we have saved these five bytes into this one.
Now we need to find the actual address of this who could function.
So in C++ or in C, it is very easy, but in this shot we need to declare something called delegate
so we can delegate each function pointer similar to the C and CBP.
So we are going to declare a delegate.
So some of this signature that exactly matches to that of this message box or whatever function we are
want to hook.
So first one is the pointer string, string integer.
So that is why I have showed you the syntax.
So now we are going to create a function public static.
But who could function.
And this takes exactly the same parameters.
So the signatures should be.
The same.
So why?
No, I have declared one function.
That should do it.
Now we need to find This is my function.
I need to find that to solve this so we can say Marshal, get function pointer for delegate.
So it will get the function address for that exact delegate.
And what we get we want is of type message.
Of tape, message and.
Who could function.
So I am getting the function pointer for this.
Who could function of the type message delegate.
And.
In the winter, we can say.
Who could function at press.
Now we got the who could function and we need to subtract Daesh to.
And we need to actually subtract these two because these five bytes, these occupied five bytes.
So it will be like a function address minus function one address minus five.
So from here onwards we are going to jump.
So.
So let's make another bite.
That is jump.
That is also five bites.
And the first one is first bite is zero nine.
So that is the jump up called opcode for the jump instruction.
And the next two four bytes will be the.
I deserve this one.
At this of this operation.
So let's.
Could a functional dress minus.
Function address.
Minus five.
So this should give me the.
Offset.
So let's say point.
And it.
Okay, we got the offset.
We need to copy these, uh, bytes into this jump so we can do that.
Uh.
Using bit converter, not get bytes.
Of this offset.
And we can directly copy without creating a new area.
So you can use a red dot copy.
This is the source area and.
The source index is zero and the destination is jump.
And the destination index is one because already in occupies the zero index and the length is four.
So we have successfully copied this offset into this area.
Now what we are to do is we going to write these bytes into this function address.
So this is like a jump to that offset.
So before that, we need to change the protection.
Functional dress and size.
Five Fibrates.
New production directs 40 that gives read, write, execute.
All product is equal to zero.
Find out.
So we have changed the.
Prediction?
No, we can copy, Master.
Copy.
Jump starting next year and the destination is the function address and the rent is jump.
Now we have all written the.
These are.
Stack.
Extract from product with this jump offset.
Now, whenever I call this function, it's going to execute, it's going to program, going to execute
to this focal function.
So we cannot call message box here.
So we have the address.
So we need to match Dot.
Get ready.
Get four function pointer.
Function address.
And that type of.
Type of message.
Now this gives me the.
This gives me the delegate so I can.
I can see a message calls to.
Paid cash this explicitly.
Now I can call this function.
So we are just executing that function at this address with this.
Parameters in pointer dot zero and let's say widget function.
Really?
From what you.
Now, whenever we call that function at this function address, the jump offset going to execute and
the program execution goes to this particular function.
Now, this is our code function.
Now we can copy back those saved bytes.
So to access these variables in this so you can make them static.
So right here.
And the next thing we want is this bites.
So.
Civil rights.
So we can access your.
So let's copy back these bites at this address.
Marsh Dot copy.
Source saved by its index zero and function address and saved by its dot length.
Now we have copied back these terabytes into this address.
Now we can call this function.
And these parameters will be passed down to this function.
So similarly.
We can copy this one and paste here.
So let's go and change this to I am from the function.
Hmm.
Not really legit.
So let's build this.
So whenever we execute this function, the jump in function gets executed and the program jumps to this
focal function.
Here we have already overwritten these bytes and the function will will execute normally because we
have already written those words.
Now we are executing whatever we want.
So let's run this and we can see here it is.
I am from the function.
And if I go and say.
Hitch.
So we are there to copy.
We are directly putting this parameter into this function.
So whatever we pass here, it will be executed as it is because it's the same parameter.
So these antivirus and EDR solutions will monitor these parameters whenever there is a call to these
functions.
So they monitor these parameters and define whether it's malicious or not.
So you can.
So we can also modify this.
If.
Spring is dark.
Contents.
It's not too low here.
Not contents.
So whenever let's say if the string pass around to this function contains a string like malicious.
So then what we're going to do is.
We are going to copy this one paste here.
So let's let's think we are the antivirus.
So whenever there is malicious in that thing so we can say sorry you are.
To.
In two other ways.
What we are going to do is we are going to just pass the parameters as it is H and L and so.
L and I.
So you are detected and you are brought.
Ah, you are wrong.
So.
So let's run this.
And it says I am from rigid function.
Whenever there is a word malicious.
It is.
You are dejected, you are broke.
So this is how Abba function.
Also looks like.
So we can say it is.
Now we can see you are detected.
So this is how you hook EPA in.