Comments (4)
There's an example in my hook library template. Please read it and let me know if you have any further questions.
from hookcase.
I still don't known how i can hook a sub function. in Hooked_sub_123abc, there are two question.
- is 123abc a relative address in the main module,so i should minus the module base address?
- if i want to hook a number-address function in none main module, how can i appoint the module name?
tks, your hookcase is a usefull project. I read your cases many times,still confused.
after tries of many times, i've got what i want. thanks again!
- yes
- patch_function can help specify the module name!
from hookcase.
I don't think there's anything I can say here that will make things clearer than than what I've already said in my documentation.
To use HookCase, you need to be familiar with disassemblers and assembly code. In my favorite disassembler, Hopper Disassembler, internal functions that aren't in a module's symbol table are given names composed of the prefix "sub_" and the function's address (in hexadecimal format) in the module's file on disk -- for example sub_123abc()
. As the example shows, you can use this "name" to hook the function by its address. HookCase figures out where the function is in actual random access memory, into which the module has been loaded.
from hookcase.
Oops, I see that you've already figured things out. I'll close this bug.
from hookcase.
Related Issues (20)
- macOS 11.4 breaks HookCase HOT 10
- Kernel panic on 11.3.1 HOT 4
- HookCase doesn't (yet) support macOS 12 HOT 3
- macOS 12.1 (build 21C52) breaks HookCase HOT 2
- Error in "sudo kmutil load -p /usr/local/sbin/HookCase.kext" macOS Big Sur 11.6.1 HOT 3
- macOS 12.3 breaks HookCase HOT 1
- macOS 12.4 breaks HookCase HOT 4
- macOS 12.5 breaks HookCase HOT 1
- macOS 10.15.7 build 19H2026 breaks HookCase HOT 1
- not Found private symbol "_proc_lock" and "_proc_unlock" On Intel hardware for MacOS 12.5 HOT 1
- which part of the key code to remove the signature restriction about DYLD_INSERT_LIBRARIES HOT 2
- Loading hook library in 'open' no longer loads it in its children
- Interpose hooks largely broken on macOS 13 (Ventura) HOT 10
- Weirdness hooking calls to `open()` in terminal apps HOT 6
- Intermittent double fault kernel panics HOT 8
- Hooked_openat_dprotected_np function cause hookcase disabled HOT 4
- Some NSObject methods crash if used from constructor functions HOT 14
- HookCase can miss a process that was launched using execv() HOT 5
- Persistent double fault kernel panics, probably caused by OpenCore Legacy Patcher HOT 24
- macOS 13.3 breaks HookCase HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from hookcase.