[Metahook] Find a function signature

Find a non-public function signature, we need a tool "IDA Pro"

(You can open picture in a new window:D)

Step 1

Load your PE file in IDA

Step 2

Find your function, you can use F5 to decompile a function

can refer to the string and function to locate your function

Step 3

Find your function signature

Open IDA Hex View

and double-click your function in function List (on IDA Window left)

Your function signature, copy this line

Step 4

Maby the signature in C + +

Now, you can use Searchpattern () to get the function address in memory.

[Metahook] Find a function signature