Discuss Features Going Forward

[stevemk14ebr]

Please propose new milestones and features for the project here. I want to create a queue of actionable tickets for myself and contributors to work on. What do you all want next, and in what order? Some potential ideas:

• Linux Port
• Language Bindings (Which?)
• ZyDis support
• Out of process support
• Inline hooks without typdef research

[stonedreamforest]

Language Bindings -> rust
and support windows kernel mode

https://github.com/ZhuHuiBeiShaDiao/PFHook
https://github.com/wbenny/hvpp
https://github.com/LordNoteworthy/cpu-internals
https://github.com/Bareflank/extended_apis_example_hook

[no-realm]

I would be interested in Inline Hooks.

[stevemk14ebr]

Some work on inline hooks without typedefs: https://github.com/stevemk14ebr/PolyHook_2_0/blob/inlineNOtypedef/UnitTests/TestAsmJit.cpp#L58

I've taken an approach here to making the typedef tunable at runtime, you still need to provide the type info for forwarding to work correctly and everything, but you can configure it at runtime now without recompiling the application. It JITs a 'Inline Callback" stub to translate the hooking function abi into the host abi using the AsmJit Library. Host ABI detection is automatic by the library, the hooked function abi is specified by the asmjit::FuncSignature structure.

This is so so so so not done yet, but the P.O.C works, which is super exciting i think (continuation after redirection doesn't work yet).

[stevemk14ebr]

@RandShot significant work has been done. I fixed a serious bug in relocation, and added JIT support for callbacks. Still need to add return value override, and return address spoofing but it's usable at this stage.

#15
https://github.com/stevemk14ebr/PolyHook_2_0/blob/master/UnitTests/TestDetourNoTDx86.cpp#L82

[no-realm]

@stevemk14ebr
I have taken a look at your example, and I must say, it looks very promising.
One question though, do you think it would be possible to somehow capture some/all registers at an arbitrary (e.g. mid function) location, read/modify them in a hook and then restore them with the modified version.
I thought that maybe you could use asmjit::x86::Assembler to do that, similar to what you have done in the example. What I am asking for basically, is register access like with breakpoints, but without any.
I don't know how realistic that is though.
At the moment I have a very hacky wrapper around minhook to do that, but it is neither efficient or clean.

If I can find the time, I may actually look into this myself. Just wanted to express my idea here :)

[stevemk14ebr]

If you can emit the proper asm stub using asmjit you can do anything, it's pretty awesome. With PolyHook you get a free transfer to anywhere without stack or register spoiling. The rest is up to you, just point PolyHook's hook constructor 'callback' param to your Jit stub like my example, and do the rest in asm.

I really like this way because then we can effectively write little 'plugins' for the detours to add features. As is the ILCallback module gives you 'dynamic' typedefs and ret spoofing (not fully done though, modified structure params aren't written back yet nor ret value)

For example you can just point PolyHook to the middle of the function, and then emit a little asmjit stub to mov whatever you want out of the reg or w/e. Just be sure to call the trampoline to transfer back and not spoil stack or regs in your stub (alignment too). This may fail to fix up jmps that point into the overwritten section in the middle as instructions before the hook address are not considered when relocating, maybe I will work on this if it is a problem

I will be working on finishing ILCallback and then ZyDis integration and then we'll see about maybe a move into kernel (probably a big move, first time doing kernel). If you want to play around with midfunction stuff i can fix any bugs you find or maybe see if you need any features/fixes, let me know how it goes.

EDIT: P.S. make sure you're on the poc_ret_spoof branch for the asmjit stuff, that's most up to date

[WasserEsser]

Adding PH2 to vcpkg would be great for getting new people to use the library.

[no-realm]

I would personally use and recommend conan, but vcpkg would be fine too, I guess.

[stevemk14ebr]

microsoft/vcpkg#4984 im fine with packaging. If anyone wants to submit packaging requests elsewhere go ahead, just let me know first

[stevemk14ebr]

I've finished work on runtime callback generation. As of today i'm merging PLH::ILCallback to master, this module will take a function typedef as a string and generate a translation stub that will move all the parameters into a structure. A pointer to this structure, and the number of args, as well as a small buffer for spoofing return value are passed to a callback method. In this callback method you may modify the arguments in the structure, they will be written back before the original is called, and you can also optionally write a return value and it will overwrite the original functions just after it's called (as it is now it always writes return value, so you must set it if you function is non-void).

Here is an example: https://github.com/stevemk14ebr/PolyHook_2_0/blob/master/UnitTests/TestDetourNoTDx86.cpp#L416 the arguments are re-written to 5, if they are equal to the value 1337 coming in. The return value is also modified to be 1337. This is x86/x64 compatible and works with all calling conventions and basic types/pointers (returning/passing structures directly is not supported).

The goal of this was to make detours runtime compatible w/o needing to recompile your callback stubs. With this work GUI tools that 'detour', and integration with other languages, are now possible

[stevemk14ebr]

I'm starting zydis integration today and then after that will work on packaging for first vcpkg then maybe more (zydis should finalize our last dependency addition for a while). If anyone wants to work on packaging master as-is for fun that work would be merged.

[stevemk14ebr]

Zydis integration is probably pre-alpha ready. It passes my simple disassembler tests so if anyone wants to poke at it have fun. There's FOR SURE issues and cases not handled yet, just message me on gitter if you find some

#10