Advertisement
Riremito

Untitled

Nov 20th, 2014
460
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.92 KB | None | 0 0
  1. 1st you have tp check what dll has the GetHashFromFile Function
  2. HMODULE hDLL = GetModuleHandleA("xxxx.dll");
  3. DWORD dwGetHashFromFile = (DWORD)GetProcAddress(hDLL, "GetHashFromFile");
  4. DWORD dwGetHashFromFile_Ret = dwGetHashFromFile+X;
  5.  
  6. HRESULT GetHashFromFile_Hook (
  7. [in] LPCSTR szFilePath,
  8. [in, out] unsigned int *piHashAlg,
  9. [out] BYTE *pbHash,
  10. [in] DWORD cchHash,
  11. [out] DWORD *pchHash
  12. ){
  13. HRESULT retval = _GetHashFromFile(szFilePath, piHashAlg, pbHash, cchHash, pchHash);
  14. //add the retval modification code here
  15. }
  16.  
  17. void _declspec(naked) _GetHashFromFile(){
  18. _asm{
  19. //original code here
  20. jmp dword ptr [dwGetHashFromFile_Ret]
  21. }
  22. }
  23.  
  24. void writehook(){
  25. DWORD old;
  26. VirtualProtect(*(DWORD *)dwGetHashFromFile, X, PAGE_EXECUTE_READWRITE, &old);
  27. *(BYTE *) dwGetHashFromFile = 0xE9;
  28. *(DWORD *)(dwGetHashFromFile+1) = (DWORD)GetHashFromFile_Hook- dwGetHashFromFile -5;
  29. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement