Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- //hooklib by capt. micro
- #ifndef BYTE
- typedef unsigned char BYTE;
- #endif
- #ifndef DWORD
- typedef unsigned int DWORD;
- #endif
- void HookCopy(BYTE *bSrc, BYTE *bDst, DWORD dwSz)
- {
- while (--dwSz) *bDst++ = *bSrc++;
- }
- void HookInstall(DWORD dwInstallAt, DWORD dwInstallSz, DWORD dwDetourFunc)
- {
- //Save instructions and generate stub before we overwrite function with the hook
- BYTE *bHookStub = (BYTE*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwInstallSz + 2 + 5 + 2 + 5);
- HookCopy(bHookStub, (BYTE*)dwInstallAt, dwInstallSz);
- *(bHookStub + dwInstallSz + 0) = 0x60 //pushad \
- *(bHookStub + dwInstallSz + 1) = 0x9C //pushfd \-----------------------\
- *(bHookStub + dwInstallSz + 2) = 0xE8 //call <users detour function> |- So we dont utterly fuck the program
- *((DWORD*)(bHookStub + dwInstallSz + 3)) = dwDetourFunc; // /
- *(bHookStub + dwInstallSz + 7) = 0x9D //popfd /----------------------/
- *(bHookStub + dwInstallSz + 8) = 0x61 //popad /
- *(bHookStub + dwInstallSz + 9) = 0xE8 //jmp <dwInstallAt + dwInstallSz> (instruction after hook)
- *((DWORD*)(bHookStub + dwInstallSz + 10)) = dwInstallAt + dwInstallSz;
- //Generate 5 byte hook and install it
- BYTE *bHookInstruction = (BYTE*)dwInstallAt;
- *(bHookInstruction + 0) = 0xE9; //jmp <hook stub>
- *((DWORD*)(bHookInstruction+1)) = bHookStub;
- //Fill the rest with NOPs (not needed really, just nice to have)
- DWORD dwNopFill = dwInstallSz - 5;
- while (dwNopFill > 0)
- {
- *(bHookInstruction + 4 + dwNopFill) = 0x90; //NOP
- dwNopFill--;
- }
- }
- void HookRemove(DWORD dwInstallAt, DWORD dwInstallSz)
- {
- //Get the address of the stub (therefore the saved instructions)
- DWORD dwStubAddr = *((DWORD*)(dwInstallAt + 1));
- BYTE *bHookStub = (BYTE*)dwStubAddr;
- //Copy the saved instructions back to the function
- HookCopy((BYTE*)dwInstallAt, bHookStub, dwInstallSz);
- //Free the stub
- HeapFree(GetProcessHeap(), 0, bHookStub);
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement