| 110 | |
| 111 | |
| 112 | BOOL Hookit(char* dllName, char* func, PROC myFunc) { |
| 113 | |
| 114 | HANDLE baseAddress = GetModuleHandle(NULL); |
| 115 | IMAGE_DOS_HEADER* DOS_HEADER = (IMAGE_DOS_HEADER*)baseAddress; |
| 116 | IMAGE_NT_HEADERS* NT_HEADER = (IMAGE_NT_HEADERS*)((DWORD64)baseAddress + DOS_HEADER->e_lfanew); |
| 117 | |
| 118 | |
| 119 | IMAGE_IMPORT_DESCRIPTOR* IMPORT_DATA = (IMAGE_IMPORT_DESCRIPTOR*)((DWORD64)baseAddress + NT_HEADER->OptionalHeader.DataDirectory[1].VirtualAddress); |
| 120 | |
| 121 | LPCSTR ModuleName = ""; |
| 122 | BOOL found = FALSE; |
| 123 | |
| 124 | while (IMPORT_DATA->Name != NULL) { |
| 125 | ModuleName = (LPCSTR)IMPORT_DATA->Name + (DWORD64)baseAddress; |
| 126 | if (_stricmp(ModuleName, dllName) == 0) { |
| 127 | found = TRUE; |
| 128 | break; |
| 129 | } |
| 130 | IMPORT_DATA++; |
| 131 | } |
| 132 | |
| 133 | if (!found) |
| 134 | return FALSE; |
| 135 | |
| 136 | PROC Sleep = (PROC)GetProcAddress(GetModuleHandleA(dllName), func); |
| 137 | |
| 138 | PIMAGE_THUNK_DATA thunk = (PIMAGE_THUNK_DATA)((PBYTE)baseAddress + IMPORT_DATA->FirstThunk); |
| 139 | while (thunk->u1.Function) { |
| 140 | PROC* FunctionAddr = (PROC*)&thunk->u1.Function; |
| 141 | |
| 142 | |
| 143 | if (*FunctionAddr == Sleep) { |
| 144 | |
| 145 | |
| 146 | DWORD oldProtect = 0; |
| 147 | VirtualProtect((LPVOID)FunctionAddr, 4096, PAGE_READWRITE, &oldProtect); |
| 148 | |
| 149 | *FunctionAddr = (PROC)myFunc; |
| 150 | |
| 151 | VirtualProtect((LPVOID)FunctionAddr, 4096, oldProtect, &oldProtect); |
| 152 | |
| 153 | return TRUE; |
| 154 | } |
| 155 | thunk++; |
| 156 | } |
| 157 | |
| 158 | return FALSE; |
| 159 | |
| 160 | |
| 161 | |
| 162 | } |
| 163 | |
| 164 | |
| 165 | void main() |