Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #include <windows.h>
- #include <fstream>
- #define SIZE 6
- typedef int (WINAPI *pMessageBoxA)(HWND, LPCSTR, LPCSTR, UINT); // typedef the FuncVairable[Fake-Reall]
- int WINAPI MyMessageBoxA(HWND, LPCSTR, LPCSTR, UINT); // Fake Function
- void BeginRedirect(LPVOID);
- pMessageBoxA pOrigMBAddress = NULL; // RealFunction
- BYTE oldBytes[SIZE] = {0}; // To Hae the backup for unhook
- BYTE JMP[SIZE] = {0}; // To have the jmp
- DWORD oldProtect, myProtect = PAGE_EXECUTE_READWRITE;
- INT APIENTRY DllMain(HMODULE hDLL, DWORD Reason, LPVOID Reserved)
- {
- switch(Reason)
- {
- case DLL_PROCESS_ATTACH: // if library loaded
- pOrigMBAddress = (pMessageBoxA)GetProcAddress(GetModuleHandle(TEXT("user32.dll")), "MessageBoxA");
- //Get Address of Function "MessageBoxA" and put it in varibal of pointer for a WIN API
- if(pOrigMBAddress != NULL) // if every thing ok >
- BeginRedirect(MyMessageBoxA); // Start hooking
- break;
- case DLL_PROCESS_DETACH: // if library unload // and unhook
- memcpy(pOrigMBAddress, oldBytes, SIZE); // but the reall function addres into the reall function
- case DLL_THREAD_ATTACH:
- case DLL_THREAD_DETACH:
- break;
- }
- return TRUE;
- }
- void BeginRedirect(LPVOID newFunction)
- {
- ///// TheJumpCode JMP x x x x RET
- BYTE tempJMP[SIZE] = {0xE9, 0x09,0x09,0x09,0x09, 0xC3}; // this is assambly code for jamp to address of fuck function (JMP NOP NOP RET)
- memcpy(JMP, tempJMP, SIZE); ///// Copy Bytes Array Form JMP to tempJMP
- // Get fake function address ==>
- // FakeFunctionAddr - ReallFunctionAddr - 5
- DWORD JMPSize = ((DWORD)newFunction - (DWORD)pOrigMBAddress - 5);
- // Allowed the realfunction vairable to write and read and get the oldProtect
- VirtualProtect((LPVOID)pOrigMBAddress, SIZE, PAGE_EXECUTE_READWRITE, &oldProtect);
- // BackUp the reallFunc addrs into oldBytes
- memcpy(oldBytes, pOrigMBAddress, SIZE); // Put pOrigMBAddress
- // Chane the - JMP [ x x x x ] RET -
- // To the fakeFunc addrs
- memcpy(&JMP[1], &JMPSize,4);
- // Chane the reallFunction addres to the [ JMP ] code
- memcpy(pOrigMBAddress, JMP, SIZE);
- // Retrun the oldProtect
- VirtualProtect((LPVOID)pOrigMBAddress, SIZE, oldProtect, NULL);
- }
- int WINAPI MyMessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uiType)
- {
- // Allowed the reallFunction Vairable to wrtie - read - execute
- VirtualProtect((LPVOID)pOrigMBAddress, SIZE, myProtect, NULL);
- // Copy the oldBytes(the realFunc addrs) to the ReallFunc Vairable
- memcpy(pOrigMBAddress, oldBytes, SIZE);
- // Execute what ever you want ->
- Beep(1000,1000);
- MessageBoxA(hWnd, "ServatonSecure", "Hooked", uiType);
- // Return the JMP
- memcpy(pOrigMBAddress, JMP, SIZE);
- // Return the oldProtect
- VirtualProtect((LPVOID)pOrigMBAddress, SIZE, oldProtect, NULL);
- // Return value to the user :)
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement