All pastes #983561 Raw Edit

Unnamed

public text v1 · immutable
·published 2008-04-13 13:24 UTC
rendered paste body
#include <windows.h>

#pragma pack(push, 1)
typedef struct _jump
{
	BYTE jmp;
	DWORD address;
} JUMP;
#pragma pack(pop)

typedef struct _prolog
{
	BYTE bytes[16];
} PROLOG;

/* B8 2B 12 00 00    mov     eax, 122Bh		*/
/* FF E0             jmp     eax			*/

BOOL hookfunc(HMODULE mod, const char *func, void *hook, BYTE *copybuf, DWORD checkbytes, DWORD copybytes)
{
	void *p;
	JUMP *j;
	DWORD prot;
	DWORD i;

	p = GetProcAddress(user32,func);
	if (!p || !VirtualProtect(p,copybytes + sizeof(JUMP),PAGE_EXECUTE_READWRITE,&prot))
		return FALSE;

	if (copybuf)
	{
		for (i = 0;i < checkbytes;i++)
		{
			if (copybuf[i] && copybuf[i] != ((BYTE *)p)[i]) return FALSE;
		}

		if (copybytes)
		{
			CopyMemory(copybuf,p,copybytes);
			j = (JUMP *)&copybuf[copybytes];
			j->jmp = 0xE9;
			j->address = (DWORD)p + copybytes - (DWORD)&copybuf[copybytes] - (DWORD)sizeof(JUMP);
		}
	}

	j = p;
	j->jmp = 0xE9;
	j->address = (DWORD)hook - (DWORD)p - (DWORD)sizeof(JUMP);

	VirtualProtect(p,copybytes + sizeof(JUMP),prot,&prot);

	return TRUE;
}