forked from j5s/ShellcodeLoader
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathMyHook.cpp
More file actions
96 lines (87 loc) · 2.28 KB
/
Copy pathMyHook.cpp
File metadata and controls
96 lines (87 loc) · 2.28 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
#include "MyHook.h"
CInlineHook::CInlineHook()
{
m_FuncAddress = NULL;
ZeroMemory(m_OriginBytes,sizeof(m_OriginBytes));
ZeroMemory(m_TargetBytes, sizeof(m_TargetBytes));
}
CInlineHook::~CInlineHook()
{
UnHook();
m_FuncAddress = NULL;
ZeroMemory(m_OriginBytes, sizeof(m_OriginBytes));
ZeroMemory(m_TargetBytes, sizeof(m_TargetBytes));
}
BOOL CInlineHook::Hook(LPCSTR pszModuleName, LPCSTR pszFuncName, PROC pfnHookFunc)
{
m_FuncAddress = (PROC)GetProcAddress(GetModuleHandle(pszModuleName),pszFuncName);
if (m_FuncAddress == NULL)
{
return FALSE;
}
SIZE_T dwRet = 0;
ReadProcessMemory(GetCurrentProcess(), m_FuncAddress, m_OriginBytes, 5, &dwRet);
m_TargetBytes[0] ='\xE9';
*(SIZE_T*)(m_TargetBytes + 1)=(LONG64)pfnHookFunc - (LONG64)m_FuncAddress - 5;
BOOL Flag=WriteProcessMemory(GetCurrentProcess(), m_FuncAddress, m_TargetBytes, 5, &dwRet);
return Flag;
}
BOOL CInlineHook::Hook64(LPCSTR pszModuleName, LPCSTR pszFuncName, PROC pfnHookFunc)
{
m_FuncAddress = (PROC)GetProcAddress(GetModuleHandle(pszModuleName), pszFuncName);
if (m_FuncAddress == NULL)
{
return FALSE;
}
SIZE_T dwRet = 0;
ReadProcessMemory(GetCurrentProcess(), m_FuncAddress, m_OriginBytes, 0xC, &dwRet);
//48 B8 0000EA4B50000000 - mov rax, 000000504BEA0000
//FF E0 - jmp rax
m_TargetBytes[0] = '\x48';
m_TargetBytes[1] = '\xB8';
m_TargetBytes[0xA] = '\xFF';
m_TargetBytes[0xB] = '\xE0';
*(PROC*)&m_TargetBytes[2] = pfnHookFunc;
BOOL Flag = WriteProcessMemory(GetCurrentProcess(), m_FuncAddress, m_TargetBytes, 0xC, &dwRet);
return Flag;
}
BOOL CInlineHook::UnHook()
{
SIZE_T dwRet = 0;
if (m_FuncAddress != 0)
{
WriteProcessMemory(GetCurrentProcess(),m_FuncAddress,m_OriginBytes,5,&dwRet);
return true;
}
return false;
}
BOOL CInlineHook::UnHook64()
{
SIZE_T dwRet = 0;
if (m_FuncAddress != 0)
{
WriteProcessMemory(GetCurrentProcess(), m_FuncAddress, m_OriginBytes, 0xC, &dwRet);
return true;
}
return false;
}
BOOL CInlineHook::ReHook()
{
SIZE_T dwRet = 0;
if (m_FuncAddress != 0)
{
WriteProcessMemory(GetCurrentProcess(), m_FuncAddress, m_TargetBytes, 5, &dwRet);
return true;
}
return 0;
}
BOOL CInlineHook::ReHook64()
{
SIZE_T dwRet = 0;
if (m_FuncAddress != 0)
{
WriteProcessMemory(GetCurrentProcess(), m_FuncAddress, m_TargetBytes, 0xC, &dwRet);
return true;
}
return 0;
}