HookPatchStuff/dllmainPushRet.cpp at main · Sargastico/HookPatchStuff · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
#include "pch.h"
#include <iostream>
#include <windows.h>


DWORD jmpBack;


bool Hook(void* toHook, void* ourFunct, int len) {

	if (len < 5) {
		return false;
	}

	DWORD curProtection;
	VirtualProtect(toHook, len, 0x40, &curProtection);

	memset(toHook, 0x90, len);


	DWORD absoluteAddress = (DWORD)ourFunct;

	*(BYTE*)toHook = 0x68;
	*(DWORD*)((DWORD)toHook + 1) = absoluteAddress;
	*(BYTE*)((DWORD)toHook + 5) = 0xC3;

	DWORD temp;
	VirtualProtect(toHook, len, curProtection, &temp);

	return true;
}

void __declspec(naked) ourFunct() {
	std::cout << "[HOOKED] ";
	__asm {
		pop ecx
		add ecx, ecx
		mov edx, [ebp - 8]
		jmp[jmpBack]
	}
}

DWORD WINAPI MainThread(LPVOID param) {


	uintptr_t hModule = (uintptr_t)GetModuleHandle(L"HackMe.exe");
	if (hModule == NULL) {
		exit(1);
	}

	int hookLength = 6;

	DWORD textSegmentOffset = 0x11000;
	DWORD instructionOffset = 0x1768;
	DWORD moduleAddress = hModule;

	DWORD hookAddress = hModule + textSegmentOffset + instructionOffset;

	jmpBack = hookAddress + hookLength;

	Hook((void*)hookAddress, ourFunct, hookLength);

	while (true) {
		if (GetAsyncKeyState(VK_ESCAPE)) break;
		Sleep(50);
	}

	FreeLibraryAndExitThread((HMODULE)param, 0);

	return 0;
}

BOOL WINAPI DllMain(HINSTANCE hModule, DWORD dwReason, LPVOID lpReserved) {
	switch (dwReason) {
	case DLL_PROCESS_ATTACH:
		CreateThread(0, 0, MainThread, hModule, 0, 0);
		break;
	}

	return TRUE;
}