Hello, and welcome back in this video, I'm going to explain the project itself and how you will go
and download the thin Dash API hooky using IoT project and zip it and put it in the metadata for the
insight.
You will find three files the compound registry, which is being used to compile the IED -- into
a DLL and also to compile the IED target.
This is a target and we are going to hook.
Let's take a look at the target list.
Right click on the target and open the cockpit.
Plus, us, it is a sin.
Same target that we used in the previous session.
Now we take a look at the IED hookah.
The I.T. -- has basically the same structure.
There is yeah, I mean, this is where the gas starts to end.
It is attached to possess and.
Once he's attached, you fulfill, you will trigger the first case, which is the sale process attached
and you execute this function called hook target.
Passing three parameters, the gear, and it contains the message box e, which we are going to hook
and also our modified message box function.
Let's take a look at the top.
So over here, we will define the function pointer, which is similar and steep recession, and this
is the modified message box, which is also similar.
This pattern is different.
This is very Sandy Hook on the original function by replacing it with our own function.
So this hook target is called from here upon attachment by the Yale.
Why is it that attaches to the target process, this function is caught and you will receive three parameters.
How are you going to say in this case user three to zero because user three to deal contains the message
box eight API.
And then the barometer would be hooking function up here.
So this is a function of is going to replace the original function.
So you say here you get the base address of the module, which is also known as the handle of the module,
and this handled the module is referring to the target possess actually base address once you get it
here and then you get the important address table.
So this is the function.
Image directory entry to get access.
This is what makes you look.
This is this is a shortcut way to get the important stable.
And this API comes from here.
The reference you can look up the image directory entry to the attacks function.
And then it is continuing the library.
That is why we included ED here, use it to library is for the message box.
So the parameters are as follows.
The first barometer is the base address.
The second parameter.
Refers to.
Whether you want to maybe as an image, so we put it through this case.
And then third is the type of directory entry that you want to retrieve.
So in this case, you won important that actually.
The import directory table.
And then the third one.
The fourth parameter is the size.
We should declare here.
And the last one you just leave as now you can read up on the expansion in more detail here.
Once you've got the important digestible IED, we save it to this variable import table next to you
research for you and it went.
In this case, you only look for he, particularly the alcohol u003e2.
Yeah.
So this is very true.
The entire import address table and look for user to the entire.
It is, and it is this language compares whether the deal is funny inside the inside the broadcast table,
so he compares it with the deal and we see one he comes from here is the target here, one which is
user data.
So if you find it, then he returns the true and it breaks out of the look.
If it's not fair, you just by returning false, can you kristie function?
So once he is funny, you will now search for a function in the import address table locally.
So he does that by using another look here and goes through every entry in sight.
The imported table.
And then why is it finally over here?
You wouldn't change permission to become read a book and write a book.
That is because you want to substitute your own function as fiber use, which are protected in order
to change the mission.
And then over here, this is the way we hook the function by assigning our own cooking function to replace
the one that is found.
So this cooking function is passed to this function here, and it is actually this one modifying message
box.
As you can see from your function call modifying message policy when you call it.
So at this point in time, the WHO is set.
And then once he said he will perform whatever is inside the money, find my message here.
And then after that, you will then we return, revert back to the original production setting.
Once it's done.
So you used your protection and assign it back to that memory region.
And then finally returns to.
So this past class is just to iterate through the entire function, you say, the Yale.
So this is how it works.
So, yes, all for the explanation on the court, for the Heidi -- in the next video, we're going
to do a practical walkthrough.
Thank you for watching.