Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #define WIN32_LEAN_AND_MEAN
- #include <windows.h>
- #define MH_DEFTRAMPOLINE(pFuncName) \
- BYTE *orig_##pFuncName; BYTE *tramp_##pFuncName
- #define MH_ALLOCTRAMPOLINE(pTrampolinePtr, bSize) \
- pTrampolinePtr = (BYTE*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, bSize+5)
- #define MH_FREETRAMOLINE(pTrampolinePtr) \
- HeapFree(GetProcessHeap(), 0, pTrampolinePtr)
- /*returns pointer to trampoline function*/
- BYTE *MH_TrampolineAdd(BYTE *pOrigFunc, BYTE *pNewFunc, BYTE *pTrampolineFunc, BYTE bSize)
- {
- BYTE bTemp;
- DWORD dwOldProt;
- VirtualProtect((void*)pTrampolineFunc, bSize+5, PAGE_EXECUTE_READWRITE, &dwOldProt);
- VirtualProtect((void*)pOrigFunc, bSize, PAGE_EXECUTE_READWRITE, &dwOldProt);
- bTemp = bSize;
- while (bTemp-- > 0) pTrampolineFunc[bTemp] = pOrigFunc[bTemp];
- pTrampolineFunc += bSize;
- pTrampolineFunc[0] = 0xE9; //JMP [rel16/32]
- *(DWORD*)(pTrampolineFunc+1) = (DWORD)((pOrigFunc+bSize - pTrampolineFunc) - 5);
- pOrigFunc[0] = 0xE9; //JMP [rel16/32]
- *(DWORD*)(pOrigFunc+1) = (DWORD)((pNewFunc - pOrigFunc) - 5);
- bTemp = 5; while (bTemp++ < bSize) pOrigFunc[bTemp] = 0x90;
- VirtualProtect((void*)pOrigFunc, bSize, dwOldProt, &dwOldProt);
- return (pTrampolineFunc - bSize);
- }
- /*returns pointer to trampoline function*/
- BYTE *MH_TrampolineRemove(BYTE *pOrigFunc, BYTE *pTrampolineFunc, BYTE bSize)
- {
- DWORD dwOldProt;
- VirtualProtect((void*)pOrigFunc, bSize, PAGE_EXECUTE_READWRITE, &dwOldProt);
- while (bSize-- > 0) pOrigFunc[bSize] = pTrampolineFunc[bSize];
- VirtualProtect((void*)pOrigFunc, bSize, dwOldProt, &dwOldProt);
- return pTrampolineFunc;
- }
- MH_DEFTRAMPOLINE(MessageBoxW);
- typedef int (WINAPI *_MessageBoxW)(HWND, LPCTSTR, LPCTSTR, UINT);
- _MessageBoxW o
- int WINAPI new_MessageBoxW(HWND hwnd, LPCTSTR text, LPCTSTR title, UINT utype)
- {
- char *newTitle = NULL;
- newTitle = (char*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, lstrlenW(title) + 15);
- lstrcpyW(newTitle, L"=|MicroHook|= "); if (title != NULL) lstrcatW(newTitle, title);
- int ret = ((_MessageBoxW)(tramp_MessageBoxW))(hwnd, text, newTitle, utype);
- MessageBoxW(0, L"WTF HOOKED", 0, 0);
- HeapFree(GetProcessHeap(), 0, newTitle);
- return ret;
- }
- BOOL WINAPI DllMain(HINSTANCE hInst, DWORD dwReason, LPVOID lpvReserved)
- {
- if (dwReason == DLL_PROCESS_ATTACH)
- {
- orig_MessageBoxW = (BYTE*)GetProcAddress(LoadLibraryA("user32.dll"), "MessageBoxW");
- MH_ALLOCTRAMPOLINE(tramp_MessageBoxW, 5);
- MH_TrampolineAdd(orig_MessageBoxW, (BYTE*)&new_MessageBoxW, tramp_MessageBoxW, 5);
- }
- else if (dwReason == DLL_PROCESS_DETACH)
- {
- MH_TrampolineRemove(orig_MessageBoxW, tramp_MessageBoxW, 5);
- MH_FREETRAMOLINE(tramp_MessageBoxW);
- }
- return (BOOL)1;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement