All pastes #88439 Raw Edit

Someone

public text v1 · immutable
·published 2006-07-14 22:43 UTC
rendered paste body
HookFunctionJMP proc STDCALL afunc:PVOID, aNewFunc:PVOID, pOldBytes:PVOID, OldBytesSize:DWORD
LOCAL oldprotect:ULONG
LOCAL newoldprotect:ULONG
.if afunc==NULL
jmp fail
.endif
.if aNewFunc==NULL
jmp fail
.endif
.if pOldBytes==NULL
jmp fail
.endif
.if OldBytesSize<5
jmp fail
.endif

mov ecx, OldBytesSize
mov edx, dword ptr [pOldBytes]
mov eax, dword ptr [afunc]

push ebx
.while ecx>0
mov bh, byte ptr [eax]
mov byte ptr [edx], bh
inc edx
inc eax
dec ecx
.endw
pop ebx

;invoke VirtualProtect, afunc,OldBytesSize,PAGE_EXECUTE_READWRITE, addr oldprotect
;.if eax==NULL
;jmp fail	
;.endif

mov eax, afunc ;Move Address to eax of original Function
mov byte ptr [eax], 0E9h ;Add the JMP Short
mov edx, aNewFunc ;Mov ebx the addy of new Function
add eax, 5 ;next intruction to calculate offset
sub edx, eax ;Subtract FiveBytesAfterFunction - AddressofnewFunction 
sub eax, 5 ;to write offset
mov dword ptr [eax+1], edx ;ZOMG OVERWRITE LOL

mov dh, 090h
mov ecx, OldBytesSize
sub ecx, 5
;ECX = Excess Bytes

.while ecx>0
mov byte ptr [eax+4+ecx],dh
dec ecx
.endw

;invoke VirtualProtect, afunc,OldBytesSize,oldprotect, addr newoldprotect
ret
fail:
mov eax,-1
ret
HookFunctionJMP endp