BlackMagic & api hooking

[roxaz911]

I noticed that lots of you guys are using this BlackMagic lib, but couldnt find it anywhere.. maybe my searching skills suck.. but anyway.. what i aim to do is to hook wow api. now i have mixed mode dll in action, works just fine. reason its mixed mode just because i like making GUI in .NET. however if there was possibility to make whole project in .NET that would be even better, cause mixed mode dll feels like some additional unnecessary work (wrappers and stuff to interact between managed <-> unmanaged).

so can BlackMagic actually hook api and where do i get this bloody lib from?

[~OddBall~]

[Only registered and activated users can see links. ]

enjoy

[roxaz911]

ah ha! thanks. seems it doesnt rly support api hooking. i guess ill stay with my mixed mode dll idea. c++ gives more control over everything anyway. thanks

[Cypher]

You could write your own .NET detours library. It wouldn't be difficult at all.

Though, being .NET its not exactly gonna be pretty to write.

[roxaz911]

well i can think of making one global hook (all in unmanaged dll) that like detects what custom function to call depending on return address on the stack, but there is a problem - what if i dont hook a call? what if i need to reimplement instructions i overwrote? that might get ugly in the process. i guess writing such lib quite defeats purpose - would still be a mess with limited functionallity.. i saw a lib tho, that lets to execute asm code in .NET, but that required supplying raw bytes of assemble code what is no good..

[Cypher]

Originally Posted by roxaz911

well i can think of making one global hook (all in unmanaged dll) that like detects what custom function to call depending on return address on the stack, but there is a problem - what if i dont hook a call? what if i need to reimplement instructions i overwrote? that might get ugly in the process. i guess writing such lib quite defeats purpose - would still be a mess with limited functionallity.. i saw a lib tho, that lets to execute asm code in .NET, but that required supplying raw bytes of assemble code what is no good..

What in the world are you rambling about?

Would you mind rephrasing that in a coherent and well thought-out manner so I don't have to spend 10 minutes trying to decipher what you're saying?

[roxaz911]

haha ok, ill try =D well we can not hook a managed function to native code (using jmp/call). so in order to hook a managed function to unmanaged code we need unmanaged hook that calls managed function. making wrapper function for each hook isnt that sexy if you have many hooks (would definitely work tho). i was thinking about sort of hook manager where manager hooks its own function same for all hooks. then it stores expected return address and managed function callback in some kind of the list. then when execution hits unmanaged manager hook it checks return address on the stack, then picks managed callback from the list and calls it passing certain params. when i thought of this tho... its possible to make manager to hook anything we want, it was just me not thinking far enough... eh nvm ^_^

[Apoc]

Originally Posted by roxaz911

haha ok, ill try =D well we can not hook a managed function to native code (using jmp/call). so in order to hook a managed function to unmanaged code we need unmanaged hook that calls managed function. making wrapper function for each hook isnt that sexy if you have many hooks (would definitely work tho). i was thinking about sort of hook manager where manager hooks its own function same for all hooks. then it stores expected return address and managed function callback in some kind of the list. then when execution hits unmanaged manager hook it checks return address on the stack, then picks managed callback from the list and calls it passing certain params. when i thought of this tho... its possible to make manager to hook anything we want, it was just me not thinking far enough... eh nvm ^_^

Big post, with a whopping two sentences.

Also, if I'm reading correctly, you have your managed, and unmanaged definitions mixed up. Anything .NET is managed code. WoW (or native code) is unmanaged.

Also, hooking unmanaged code is not as hard as you think. It does require a sort of runaround, but nothing hard at all. Do some research about how to call managed code from unmanaged code.

[roxaz911]

i have nothing mixed up as i am running mixed mode dll which contains both - managed and unmanaged code ;] anyway that is trivial to me right now as i decided to use native wow UI for what i do ;]