kLoEr - Coding & Reversing

代碼是 C 的, 亂挖挖到 ,寫得還不錯


DWORD HookFunction(LPCSTR lpModule, LPCSTR lpFuncName, LPVOID lpFunction, unsigned char *lpBackup)
{
 DWORD dwAddr = (DWORD)GetProcAddress(GetModuleHandle(lpModule), lpFuncName);
 BYTE ReplaceCode[6] = { 0xe9, 0x00, 0x00, 0x00, 0x00, 0xc3 };

 ReadProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, lpBackup, 6, 0);

 DWORD dwCalc = ((DWORD)lpFunction - dwAddr - 5);

 memcpy(&ReplaceCode[1], &dwCalc, 4);

 WriteProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, ReplaceCode, 6, 0);

 return dwAddr;
}

BOOL UnHookFunction(LPCSTR lpModule, LPCSTR lpFuncName, unsigned char *lpBackup)
{
 DWORD dwAddr = (DWORD)GetProcAddress(GetModuleHandle(lpModule), lpFuncName);

 if (WriteProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, lpBackup, 6, 0))
  return TRUE;

 return FALSE;
}