Advertisement
HyperionSRC

HLH COPYPASTEN

Nov 10th, 2012
112
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.77 KB | None | 0 0
  1. #include <windows.h>
  2.  
  3. #define SIZE 6
  4.  
  5. typedef int (WINAPI *pMessageBoxW)(HWND, LPCWSTR, LPCWSTR, UINT);
  6. int WINAPI MyMessageBoxW(HWND, LPCWSTR, LPCWSTR, UINT);
  7.  
  8. void BeginRedirect(LPVOID);
  9.  
  10. pMessageBoxW pOrigMBAddress = NULL;
  11. BYTE oldBytes[SIZE] = {0};
  12. BYTE JMP[SIZE] = {0};
  13. DWORD oldProtect, myProtect = PAGE_EXECUTE_READWRITE;
  14.  
  15. INT APIENTRY DllMain(HMODULE hDLL, DWORD Reason, LPVOID Reserved)
  16. {
  17.     switch(Reason)
  18.     {
  19.     case DLL_PROCESS_ATTACH:
  20.         pOrigMBAddress = (pMessageBoxW)
  21.             GetProcAddress(GetModuleHandle("user32.dll"),
  22.                            "MessageBoxW");
  23.         if(pOrigMBAddress != NULL)
  24.             BeginRedirect(MyMessageBoxW);    
  25.         break;
  26.     case DLL_PROCESS_DETACH:
  27.         memcpy(pOrigMBAddress, oldBytes, SIZE);
  28.     case DLL_THREAD_ATTACH:
  29.     case DLL_THREAD_DETACH:
  30.         break;
  31.     }
  32.     return TRUE;
  33. }
  34.  
  35. void BeginRedirect(LPVOID newFunction)
  36. {
  37.     BYTE tempJMP[SIZE] = {0xE9, 0x90, 0x90, 0x90, 0x90, 0xC3};
  38.     memcpy(JMP, tempJMP, SIZE);
  39.     DWORD JMPSize = ((DWORD)newFunction - (DWORD)pOrigMBAddress - 5);
  40.     VirtualProtect((LPVOID)pOrigMBAddress, SIZE,
  41.                     PAGE_EXECUTE_READWRITE, &oldProtect);
  42.     memcpy(oldBytes, pOrigMBAddress, SIZE);
  43.     memcpy(&JMP[1], &JMPSize, 4);
  44.     memcpy(pOrigMBAddress, JMP, SIZE);
  45.     VirtualProtect((LPVOID)pOrigMBAddress, SIZE, oldProtect, NULL);
  46. }
  47.  
  48. int  WINAPI MyMessageBoxW(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uiType)
  49. {
  50.     VirtualProtect((LPVOID)pOrigMBAddress, SIZE, myProtect, NULL);
  51.     memcpy(pOrigMBAddress, oldBytes, SIZE);
  52.     int retValue = MessageBoxW(hWnd, lpText, lpCaption, uiType);
  53.     memcpy(pOrigMBAddress, JMP, SIZE);
  54.     VirtualProtect((LPVOID)pOrigMBAddress, SIZE, oldProtect, NULL);
  55.     return retValue;
  56. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement