Advertisement
Guest User

Untitled

a guest
Jun 23rd, 2017
51
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.15 KB | None | 0 0
  1. #include <Windows.h>
  2. #include <iostream>
  3.  
  4. using namespace std;
  5.  
  6. typedef BOOL (__stdcall * FlushInstructionCache_t)(HANDLE hProcess,LPCVOID lpBaseAddress,SIZE_T dwSize);
  7. FlushInstructionCache_t pFlushInstructionCache;
  8.  
  9. void* detourFunc(BYTE *src, const BYTE *dst, const int len)
  10. {
  11.     BYTE *jmp = (BYTE*)malloc(len+5);
  12.     DWORD dwback;
  13.  
  14.     VirtualProtect(src, len, PAGE_READWRITE, &dwback);
  15.  
  16.     memcpy(jmp, src, len);  jmp += len;
  17.  
  18.     jmp[0] = 0xE9;
  19.     *(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
  20.  
  21.     src[0] = 0xE9;
  22.     *(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
  23.  
  24.     VirtualProtect(src, len, dwback, &dwback);
  25.  
  26.     return (jmp-len);
  27. }
  28.  
  29. BOOL __stdcall hkFlushInstructionCache(HANDLE hProcess,LPCVOID lpBaseAddress,SIZE_T dwSize)
  30. {
  31.      cout << "FlushInstructionCache" << endl;
  32.  
  33.     return pFlushInstructionCache(hProcess, lpBaseAddress, dwSize);
  34. }
  35.  
  36. int main()
  37. {
  38.     DWORD dwFlushInstructionCache = (DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "FlushInstructionCache");
  39.     pFlushInstructionCache = (FlushInstructionCache_t)detourFunc((BYTE*)dwFlushInstructionCache, (BYTE*)&hkFlushInstructionCache, 3); //para = size
  40.  
  41.     system("PAUSE");
  42.     return 0;
  43. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement