View Full Version : Function hooking on ARM

October 15th, 2010, 01:57

I've implemented a function hooker on ARM that works well so far(as a linux kernel module):

1. Preserve the target's first 2 instructions to a structure.(8 bytes)
2. Write ldr pc, [pc-#4], to the first instruction. (4 bytes)
3. Write the new function address. (4 bytes)
4. Then in the new function, the callee can reference to a global hook structure that has info obtained in (1). Like ((pfunc)(&hook_info.invoke))(pass thru the arguments).

The hook_info structure looks like this:

[1st preserved instruction]
[2nd preserved instruction]
ldr pc, [pc-#4]
[target offset + 8]

However, this method will be broken if the 1st two instructions of the target function contain PC-relative addressing mode.

So now I have an idea to perform a 4 steps jump...

First jump:

new_function:somewhere -> hook_structure

Second jump:

Restore 2 instructions at target_function.
Hook at target_function+8 to hook_Structure2.
hook_structure:somewhere -> target_function

Third jump:

target_function:8 -> hook_structure2

Fourth jump:

Hook at target_function again to new_function.
Restore 2 instructions at target_function+8.
hook_structure2 -> target_function+8

By interchanging the instructions and hook of the first 2 pairs of instructions, it should be possible to execute the preserved instruction in the original context without any side effect.

It looks quite complicated... Is there any best practise or common techniques to perform the same thing?