forked from mangosd1337/GameHackingCode
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathIATHookExample.cpp
More file actions
74 lines (61 loc) · 2.34 KB
/
Copy pathIATHookExample.cpp
File metadata and controls
74 lines (61 loc) · 2.34 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
#include "main.h"
// this is the function that scans the import table and
// overwrites the target function address with our hook
// destination address
DWORD hookIAT(const char* functionName, DWORD newFunctionAddress)
{
DWORD baseAddress = (DWORD)GetModuleHandle(NULL);
auto dosHeader = pointMemory<IMAGE_DOS_HEADER>(baseAddress);
if (dosHeader->e_magic != 0x5A4D)
return 0;
auto optHeader = pointMemory<IMAGE_OPTIONAL_HEADER>(baseAddress + dosHeader->e_lfanew + 24);
if (optHeader->Magic != 0x10B)
return 0;
if (optHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size == 0 ||
optHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress == 0)
return 0;
IMAGE_IMPORT_DESCRIPTOR* importDescriptor = pointMemory<IMAGE_IMPORT_DESCRIPTOR>(baseAddress + optHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress); //what is the rule of adding them?
while (importDescriptor->FirstThunk)
{
int n = 0;
IMAGE_THUNK_DATA* thunkData = pointMemory<IMAGE_THUNK_DATA>(baseAddress + importDescriptor->OriginalFirstThunk);
while (thunkData->u1.Function)
{
char* importFunctionName = pointMemory<char>(baseAddress + (DWORD)thunkData->u1.AddressOfData + 2);
if (strcmp(importFunctionName, functionName) == 0)
{
auto vfTable = pointMemory<DWORD>(baseAddress + importDescriptor->FirstThunk);
DWORD original = vfTable[n];
auto oldProtection = protectMemory<DWORD>((DWORD)&vfTable[n], PAGE_READWRITE);
vfTable[n] = newFunctionAddress;
protectMemory<DWORD>((DWORD)&vfTable[n], oldProtection);
return original;
}
n++;
thunkData++;
}
importDescriptor++;
}
return 0;
}
// this our our type-def that minmics the function type
// of the function being hooked. This allows us to use a
// clean call to the original function just knowing it's address
typedef VOID (WINAPI _origSleep)(DWORD ms);
_origSleep* originalSleep;
// this is the function we re-direct any Sleep() call to.
// it simply denies all Sleep calls that last for more than
// 100 miliseconds, printing some text upon success
VOID WINAPI newSleepFunction(DWORD ms)
{
if (ms > 100)
printf("Sleep hook worked! Denied sleep for %d miliseconds.\n", ms);
else
originalSleep(ms);
}
// This is the function that ties everything together
void IATHookExample()
{
originalSleep = (_origSleep*)hookIAT("Sleep", (DWORD)&newSleepFunction);
Sleep(1234);
}