Question

I have been playing around with pointers and function pointers in c/c++. As you can get the adress of a function, can you change where a function call actually ends?

I tried getting the memory adress of a function, then writing a second functions adress to that location, but it gave me a access violation error.

Regards,

Answer 1

If the function you’re trying to call is inlined, then you’re pretty much out of luck. However, if it’s not inlined, then there may be a way:

On Unix systems there’s a common feature of the dynamic linker called LD_PRELOAD which allows you to override functions in shared libraries with your own versions. See the question What is the LD_PRELOAD trick? for some discussion of this. If the function you’re trying to hijack is not loaded from a shared library (i.e. if it’s part of the executable or if it’s coming from a statically linked library), you’re probably out of luck.

On Windows, there are other attack vectors. If the function to be hooked is exported by some DLL, you could use Import Address Table Patching to hijack it without tinkering with the code of the function. If it’s not exported by the DLL but you can get the address of it (i.e. by taking the address of a function) you could use something like the free (and highly recommended) N-CodeHook project.