c++dll-injection

Access method's parameter with dll injection


I have a 64bit process, I figured out one of its statically linked library methods.

Source of this method:

int SSL_connect(SSL *s)
{
    if (s->handshake_func == 0)
        /* Not properly initialized yet */
        SSL_set_connect_state(s);

    return (s->method->ssl_connect(s));
}

Actual assembly image: click here.

What I want to do is using dll injection in order to access SSL parameter. I'm using x64dbg + ScyllaHide plugin to inject dlls, so any custom injection tools shouldn't be needed. I successfully injected a simple dll into this process, so I think it's enough for this case.

Is there any chance to access the variable from here without any modification of assembly? Could anyone throw me some bone, please? (I don't ask for code, I just need some hint as I'm rather a newbie to C++ and dll injection world than an expert).


Solution

  • If you can find out the address of the SSL_connect function you can detour it. This means that you can write a JMP instruction at the begin of the method to your patched-method.

    If your jumped-to method has the same calling convention and signature you can simply access SSL* and do what you want with it afterwards you can jump back...

    To let the jump back work you would need to restore the org code or create a copy of the org method...

    Another way would be a Hardware-Break-Point: read for example here.