View difference between Paste ID: YZh4u8Zw and ZdXztf76

 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
-#define SIZE 6
+
 #define MH_DEFTRAMPOLINE(pFuncName) \
-typedef int (WINAPI *pMessageBoxW)(HWND, LPCWSTR, LPCWSTR, UINT);
+	BYTE *orig_##pFuncName; BYTE *tramp_##pFuncName
-int WINAPI MyMessageBoxW(HWND, LPCWSTR, LPCWSTR, UINT);
+#define MH_ALLOCTRAMPOLINE(pTrampolinePtr, bSize) \
 	pTrampolinePtr = (BYTE*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, bSize+5)
-void BeginRedirect(LPVOID);
+#define MH_FREETRAMOLINE(pTrampolinePtr) \
 	HeapFree(GetProcessHeap(), 0, pTrampolinePtr)
-pMessageBoxW pOrigMBAddress = NULL;
+
-BYTE oldBytes[SIZE] = {0};
+/*returns pointer to trampoline function*/
-BYTE JMP[SIZE] = {0};
+BYTE *MH_TrampolineAdd(BYTE *pOrigFunc, BYTE *pNewFunc, BYTE *pTrampolineFunc, BYTE bSize)
-DWORD oldProtect, myProtect = PAGE_EXECUTE_READWRITE;
+
 	BYTE bTemp;
-INT APIENTRY DllMain(HMODULE hDLL, DWORD Reason, LPVOID Reserved)
+	DWORD dwOldProt;
 	VirtualProtect((void*)pTrampolineFunc, bSize+5, PAGE_EXECUTE_READWRITE, &dwOldProt);
-    switch(Reason)
+	VirtualProtect((void*)pOrigFunc, bSize, PAGE_EXECUTE_READWRITE, &dwOldProt);
-    {
+	bTemp = bSize;
-    case DLL_PROCESS_ATTACH:
+	while (bTemp-- > 0) pTrampolineFunc[bTemp] = pOrigFunc[bTemp];
-        pOrigMBAddress = (pMessageBoxW)
+	pTrampolineFunc += bSize;
-            GetProcAddress(GetModuleHandle("user32.dll"),
+	pTrampolineFunc[0] = 0xE9; //JMP [rel16/32]
-                           "MessageBoxW");
+	*(DWORD*)(pTrampolineFunc+1) = (DWORD)((pOrigFunc+bSize - pTrampolineFunc) - 5);
-        if(pOrigMBAddress != NULL)
+	pOrigFunc[0] = 0xE9; //JMP [rel16/32]
-            BeginRedirect(MyMessageBoxW);
+	*(DWORD*)(pOrigFunc+1) = (DWORD)((pNewFunc - pOrigFunc) - 5);
-        break;
+	bTemp = 5; while (bTemp++ < bSize) pOrigFunc[bTemp] = 0x90;
-    case DLL_PROCESS_DETACH:
+	VirtualProtect((void*)pOrigFunc, bSize, dwOldProt, &dwOldProt);
-        memcpy(pOrigMBAddress, oldBytes, SIZE);
+	return (pTrampolineFunc - bSize);
-    case DLL_THREAD_ATTACH:
+
-    case DLL_THREAD_DETACH:
+
-        break;
+/*returns pointer to trampoline function*/
-    }
+BYTE *MH_TrampolineRemove(BYTE *pOrigFunc, BYTE *pTrampolineFunc, BYTE bSize)
-    return TRUE;
+
 	DWORD dwOldProt;
 	VirtualProtect((void*)pOrigFunc, bSize, PAGE_EXECUTE_READWRITE, &dwOldProt);
-void BeginRedirect(LPVOID newFunction)
+	while (bSize-- > 0) pOrigFunc[bSize] = pTrampolineFunc[bSize];
 	VirtualProtect((void*)pOrigFunc, bSize, dwOldProt, &dwOldProt);
-    BYTE tempJMP[SIZE] = {0xE9, 0x90, 0x90, 0x90, 0x90, 0xC3};
+	return pTrampolineFunc;
-    memcpy(JMP, tempJMP, SIZE);
+
-    DWORD JMPSize = ((DWORD)newFunction - (DWORD)pOrigMBAddress - 5);
+
-    VirtualProtect((LPVOID)pOrigMBAddress, SIZE,
+MH_DEFTRAMPOLINE(MessageBoxW);
-                    PAGE_EXECUTE_READWRITE, &oldProtect);
+typedef int (WINAPI *_MessageBoxW)(HWND, LPCTSTR, LPCTSTR, UINT);
-    memcpy(oldBytes, pOrigMBAddress, SIZE);
+_MessageBoxW o
-    memcpy(&JMP[1], &JMPSize, 4);
+int WINAPI new_MessageBoxW(HWND hwnd, LPCTSTR text, LPCTSTR title, UINT utype)
-    memcpy(pOrigMBAddress, JMP, SIZE);
+
-    VirtualProtect((LPVOID)pOrigMBAddress, SIZE, oldProtect, NULL);
+	char *newTitle = NULL;
 	newTitle = (char*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, lstrlenW(title) + 15);
 	lstrcpyW(newTitle, L"=|MicroHook|= "); if (title != NULL) lstrcatW(newTitle, title);
-int  WINAPI MyMessageBoxW(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uiType)
+	int ret = ((_MessageBoxW)(tramp_MessageBoxW))(hwnd, text, newTitle, utype);
 	MessageBoxW(0, L"WTF HOOKED", 0, 0);
-    VirtualProtect((LPVOID)pOrigMBAddress, SIZE, myProtect, NULL);
+	HeapFree(GetProcessHeap(), 0, newTitle);
-    memcpy(pOrigMBAddress, oldBytes, SIZE);
+	return ret;
-    int retValue = MessageBoxW(hWnd, lpText, lpCaption, uiType);
+
-    memcpy(pOrigMBAddress, JMP, SIZE);
+
-    VirtualProtect((LPVOID)pOrigMBAddress, SIZE, oldProtect, NULL);
+BOOL WINAPI DllMain(HINSTANCE hInst, DWORD dwReason, LPVOID lpvReserved)
-    return retValue;
+
 	if (dwReason == DLL_PROCESS_ATTACH)
 	{
 		orig_MessageBoxW = (BYTE*)GetProcAddress(LoadLibraryA("user32.dll"), "MessageBoxW");
 		MH_ALLOCTRAMPOLINE(tramp_MessageBoxW, 5);
 		MH_TrampolineAdd(orig_MessageBoxW, (BYTE*)&new_MessageBoxW, tramp_MessageBoxW, 5);
 	}
 	else if (dwReason == DLL_PROCESS_DETACH)
 	{
 		MH_TrampolineRemove(orig_MessageBoxW, tramp_MessageBoxW, 5);
 		MH_FREETRAMOLINE(tramp_MessageBoxW);
 	}
 	return (BOOL)1;
 }