Welcome in this new session, we are going to do some practical walkthrough on API cooking using detours,
going down this project just by hooking, using to us unzip it and put it in the folder.
Inside you find a few files.
Initially, you won't have this file.
Will be building this car.
And also, you wouldn't have these who could Al will be building this -- the.
So this is our --, and he is our target.
So the target looks like this less open, not bad.
Plus plus and study the good.
It is a simple program.
It is just going to show three message boxes.
First message box, second message box and message box.
That's all.
So what we are going to do is to intercept this message box function calls and do something using it
to us and to do that.
We need to rein in this program called Hook.
Don't keep this open, this heath.
Not that fast.
Plus.
So who could?
The recipe is actually a guy how you are going to be many attaches to the target process.
In this case, our target process is target for when he attaches to target fall guy.
You call the hook function.
Who targets function.
And when it detaches from the target for whoever you will call the unhook target function.
So let's take a look at the whole target function in order to use in order to build this year.
We need to include the G2's library and we can do that by including the editors dickish.
So what's he included?
He took it or his you access.
You would have access to the the location data as far as soon as the entire iTunes library, which is
in this folder now too.
You can actually download all of this from Microsoft, GitHub and the link is provided in this file
here.
You can download this file here.
This file continue to all the tools Microsoft GitHub page where you can download the latest library,
but I've already downloaded.
So you didn't have to do it.
He is make use of this.
And you can also read about the Microsoft Detours description of the project here as well.
And this is where you can download articles written by the editors creator, which we discussed in your
previous lesson.
So this is how you include to a library.
Now, take a look at the WHO target here.
The WHO target is the function we should be call granny attached to the target for hookah.
So the whole target who perform the you said you're hooked on the message box function.
So in this case, you are targeting message box, that's why we are using the message box here in this
program.
So he uses transactions over here.
We declare who visa to get hold of the media and who was successful.
And here is where you need to call the few functions that will perform.
You who can.
First function used to initialize it by calling a detour transaction, begin function and then you get
new contract.
Yeah, by calling, they need to update track.
The current set would be to try and get the -- attached to, in this case, staggered from the.
Then he will perform the attach to the idea, will do the interception of the function call.
So he's very specify what function are you going to set?
In this case, you are going to send the message box function.
So you need to specify as a first parameter and then second parameter is where you specify the modified
version of the API that you have there you are going to use to replace the original API.
And this pointer, this is a function pointer, is declared up here.
And this is a pointer to the original message box formation, and you should follow exactly the.
The what prototype?
And that you would get from the media so you can go to media and take a look at I function prototype.
So the message in box API is we will learn from this Microsoft website.
And this is what it looks like he has got these four parameters.
And here you can read all of the details of the parametres, which you need to pass when you declare
a message box function your you.
So take a look at this.
The first parameter is your handle to the window and parent.
If you do not have a parent, you can leave it blank.
Right?
So in this case here you want to declare this function front function pointer.
So only to do is just copy the entire function for a time.
From here?
Copy and paste it here.
Ladies, April.
And they over here converted into a function pointer by putting the bracket in front in the back and
in casting as a focal point of my doing this and then just giving you variable name for the name of
the function point to his colleague.
In this case, you call it the original message box and then you see where you can use it.
And here you are saying the message box API to the function point.
So all of this comes from message box comes from user 32 library and it is described here.
So you go to the same as the engine screw all the way down.
You'll be able to see the source of the message box, which is actually used to library.
So that's why we need to include this site here to compile to link it together with the when the link
comes, when Link does his job.
So this is where you use it.
You included.
So when you when the terrorist attacks, you can't target, so who target who then do all these things
and then attack?
And then after you commit communist way, he performs the actual execution.
All we have, he has to specify up here.
So when he committed, you will return, resigning his story in this veritable cooking visa.
And then we just bring a message to let the user know in a common, common and terminal message.
Same message box who and who can result in such and such and unusual networking result?
And we tend to.
And then when the when the network is detaching from the target, he will then call the unhook target
function.
The target function is over here.
What he does is undo the hooks and revert changes to origin and code.
And as usual, we use the variable and hooking result up here, the user who can answer here we declare
an organizer and you perform the same transaction function calls.
By this time you unhooking, you call detour detection instead of two attach.
And then once the committee, you return the result here and you bring a message to the user to let
the user know who's at the who has been removed from the message box with the uncanny result such and
such.
And you print the unhooking result and you return true.
So here is how the hook works.
And so that's all for this explanation in the next video, we're going to do the practical on on this.
So thank you for watching.
I'll see you next on.