1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99
|
#include <Windows.h>
#include <iostream>
#include <string>
#include <TCHAR.H>
#include "main.h"
using namespace std;
DWORD jmpBackAddy;
DWORD buffer_ptr;
bool Hook(void * toHook, void * ourFunct, int len)
{
if (len < 5)
{
return false;
}
else
{
}
DWORD curProtection;
VirtualProtect(toHook, len, PAGE_EXECUTE_READWRITE, &curProtection);
memset(toHook, 0x90, len);
DWORD relativeAddress = ((DWORD)ourFunct - (DWORD)toHook) - 5;
*(BYTE*)toHook = 0xE9;
*(DWORD*)((DWORD)toHook + 1) = relativeAddress; // <-- I DID NOT UNDERSTAND THIS
DWORD temp;
VirtualProtect(toHook, len, curProtection, &temp);
return true;
}
//
//
void __declspec(naked) ourFunct()
{
__asm{
mov esi,ecx
cmp eax,1000040
je codey
jmp code20
code20:
cmp eax,1001010
je codey
jmp code
codey:
mov eax,0
jmp code
hid:
mov eax,1001010
jmp code
code:
mov dword ptr ds:[esi],eax
lea eax,dword ptr ds:[edi+4]
jmp jmpBackAddy
}
}
DWORD WINAPI MainThread(LPVOID param)
{
int hookLength = 7;//5 for jump + 3 remaining
// DWORD hookAddress = 0x4E9DEA; // it's right
DWORD hookAddress = 0x4E972C; // it's right
jmpBackAddy = hookAddress + hookLength;
Hook((void*)hookAddress, ourFunct, hookLength);
return 0;
}
BOOL WINAPI DllMain(HINSTANCE hModule, DWORD dwReason, LPVOID lpReserved) {
switch (dwReason) {
case DLL_PROCESS_ATTACH:
CreateThread(0, 0, MainThread, hModule, 0, 0);
break;
}
return TRUE;
}
| |