Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #include "stdafx.h"
- #include <fstream>
- #include <Windows.h>
- #define Naked __declspec(naked)
- #define stdcall __stdcall
- void PlaceJmp(HANDLE hwnd, PVOID JumpFrom, DWORD JumpTo){
- DWORD old;
- DWORD bkup;
- DWORD JmpOffset = (DWORD)JumpTo - (DWORD)JumpFrom - 5;
- VirtualProtectEx(hwnd, JumpFrom, 5, PAGE_EXECUTE_READWRITE, &old);
- *(BYTE*)JumpFrom = 0xE9;
- *(DWORD*)((DWORD)JumpFrom+1) = JmpOffset;
- VirtualProtectEx(hwnd, JumpFrom, 5, old, &bkup);
- }
- PVOID GetHookedAddress(PVOID address){
- if (*(unsigned char*)address == 0xE9){
- return (PVOID)(*(DWORD*)((DWORD)address + 1) + (DWORD)address + 5);
- }
- else return (PVOID)0;
- }
- PVOID HookSetup(PVOID HookAddr, PVOID CallThis){
- PVOID HookSpace = VirtualAlloc(NULL, 1024, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
- PlaceJmp((HANDLE)-1, HookSpace, (DWORD)CallThis);
- *(char*)HookSpace = 0xE8;
- PVOID SpaceOffset1 = (PVOID)((DWORD)HookSpace + 5);
- PVOID AlreadyHooked = GetHookedAddress(HookAddr);
- if (AlreadyHooked) PlaceJmp((HANDLE)-1, SpaceOffset1, (DWORD)AlreadyHooked);
- else {
- char StolenBytes[5];
- ReadProcessMemory((HANDLE)-1, HookAddr, StolenBytes, 5, NULL);
- WriteProcessMemory((HANDLE)-1, SpaceOffset1, StolenBytes, 5, NULL);
- }
- PlaceJmp((HANDLE)-1, (PVOID)((DWORD)HookSpace + 10), (DWORD)HookAddr + 5);
- return HookSpace;
- }
- void LockDLL(HMODULE DllHandle){
- TCHAR moduleName[1024];
- GetModuleFileName(
- DllHandle,
- moduleName,
- sizeof(moduleName) / sizeof(TCHAR));
- LoadLibrary(moduleName);
- }
- BOOL WINAPI WPM_HOOK(
- _In_ HANDLE hProcess,
- _In_ LPVOID lpBaseAddress,
- _In_ LPCVOID lpBuffer,
- _In_ SIZE_T nSize,
- _Out_ SIZE_T *lpNumberOfBytesWritten
- ){
- std::ofstream ofs;
- ofs.open("HookedData.txt", std::ofstream::out | std::ofstream::app);
- ofs << "WPM: "<<std::endl;
- ofs << "Addr: "<<lpBaseAddress<<std::endl;
- ofs << "First 16 bytes: "<<std::hex;
- for (int i = 0; i < 16; i++){
- ofs << +((BYTE*)lpBuffer)[i]<<" ";
- }
- ofs << std::endl;
- ofs << "Size: " << nSize << std::endl <<std::endl;
- ofs.close();
- return 1;
- }
- BOOL WINAPI RPM_HOOK(
- _In_ HANDLE hProcess,
- _In_ LPCVOID lpBaseAddress,
- _Out_ LPVOID lpBuffer,
- _In_ SIZE_T nSize,
- _Out_ SIZE_T *lpNumberOfBytesRead
- ){
- std::ofstream ofs;
- ofs.open("HookedData.txt", std::ofstream::out | std::ofstream::app);
- ofs << "ReadProcessMemory: " << std::endl;
- ofs << "Addr: " << lpBaseAddress << std::endl;
- ofs << "Receiver Address: " << lpBuffer << std::endl;
- ofs << "Size: " << nSize << std::endl << std::endl;
- ofs.close();
- return 1;
- }
- BOOL WINAPI DllMain(
- _In_ HINSTANCE hinstDLL,
- _In_ DWORD fdwReason,
- _In_ LPVOID lpvReserved
- ){
- if (fdwReason == DLL_PROCESS_ATTACH){
- LockDLL(hinstDLL);
- PVOID WPM = (PVOID)GetProcAddress(GetModuleHandleA("kernel32.dll"), "WriteProcessMemory");
- PVOID RPM = (PVOID)GetProcAddress(GetModuleHandleA("kernel32.dll"), "ReadProcessMemory");
- PlaceJmp((HANDLE)-1, RPM, (DWORD)RPM_HOOK);
- PlaceJmp((HANDLE)-1, WPM, (DWORD)WPM_HOOK);
- LockDLL(hinstDLL);
- }
- }
Add Comment
Please, Sign In to add comment