[WIN x64]API Hook[Code overwriting]

[quote='eKKiM' pid='14358780' dateline='1312612948']
Hi

i'm releasing an old piece of code i used for hooking on x64 processes.
This method is a bit more advanced then IAT hooking, instead i use code overwriting which requires some assembler..

the code is BUGGY! but works in (some/most) cases.
I wrote it long time ago when i was VERY n00b xD.
so this function is far complete. i dont check if the winapi's fail etc..

However because i see a lot of people is intersted over here in DLL Injection and hooking, i decided to release it.
You should be able to find out the basics of this hooking method.

another little side note: you need a length disassembler.
You could use diStorm to disassemble it and get length from it

[php]void APIHook(DWORD64 HookFunc, DWORD64 MyFunc, DWORD64 *DetourFunc)
{
BYTE lpBackup[20];
DWORD64 dwCalc;
int iLength = 0;
SIZE_T result;

BYTE jmp[13] = { 0x49, //mov
0xBB, //r11
0x00, //address (64-bit)
0x00, // ..
0x00, // ..
0x00, // ..
0x00, // ..
0x00, // ..
0x00, // ..
0x00, // ..
0x41, //??
0xff, //jmp
0xe3 }; //r11

BYTE trampBuild[40] = { 0x90, //original data (filled with NOPs)
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // .. (15 bytes is max opcode)
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x90, // ..
0x49, //mov
0xBB, //r11
0x00, //address (64-bit)
0x00, // ..
0x00, // ..
0x00, // ..
0x00, // ..
0x00, // ..
0x00, // ..
0x00, // ..
0x41, //??
0xff, //jmp
0xe3 }; //r11

BYTE *pTramp = (BYTE *) VirtualAlloc(NULL, sizeof(trampBuild), MEM_COMMIT, PAGE_EXECUTE_READWRITE);

while (iLength < sizeof(jmp))
iLength = iLength + LDE(HookFunc + (DWORD64) iLength, 64);

ReadProcessMemory(GetCurrentProcess(), (LPVOID)HookFunc, lpBackup, iLength, 0);

ReadProcessMemory(GetCurrentProcess(), (LPVOID)HookFunc, lpBackup, iLength, 0);
memcpy(&trampBuild[0], &lpBackup, iLength);

memcpy(&jmp[2], &MyFunc, ;
WriteProcessMemory(GetCurrentProcess(), (LPVOID)HookFunc, jmp, sizeof(jmp), &result);

dwCalc = (DWORD64)((HookFunc + (DWORD64) (iLength)));
memcpy(&trampBuild[29], &dwCalc, ;

memcpy(&pTramp[0], &trampBuild, sizeof(trampBuild));
*DetourFunc = (DWORD64) pTramp;

ReadProcessMemory(GetCurrentProcess(), (LPVOID)HookFunc, lpBackup, iLength, 0);

return;
}[/php]

Now let's get the flaming started about my ugly code xD
[/quote]