[MetaHook] Find a function signature

Find a non-public function signature, we need a tool "IDA Pro"

( You can open picture in a new window :D )

Step 1

Load your PE file in IDA

Step 2

Find your function, you can use F5 to decompile a function

You can refer to the string and function to locate your function

Step 3

Find your function signature

Open IDA Hex view

And double-click your function in Function List (on IDA Window left)

All right, this is your function signature, copy this line

Step 4

Maby you use the signature in C/C++

 

Now, you can use SearchPattern() to get the function address in memory.