-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathmemory.c
More file actions
60 lines (51 loc) · 1.22 KB
/
memory.c
File metadata and controls
60 lines (51 loc) · 1.22 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
#include "memory.h"
static DWORD defaultBase = 0x0400000;
static DWORD imageBase = 0;
static DWORD imageSize = 0;
void queryImage(void)
{
MODULEINFO moduleInfo;
if (GetModuleInformation(GetCurrentProcess(), GetModuleHandle(NULL), &moduleInfo, sizeof(moduleInfo)))
{
imageBase = (DWORD)moduleInfo.lpBaseOfDll;
imageSize = moduleInfo.SizeOfImage;
}
}
DWORD convertAddress(DWORD addr)
{
return imageBase - defaultBase + addr;
}
// Based on SpecialK's SK_Scan
void *findAddress(PBYTE pattern, BYTE len)
{
if (!imageBase || !imageSize)
return NULL;
PBYTE base = (PBYTE)imageBase;
PBYTE cur = base;
PBYTE end = base + imageSize;
BYTE i = 0;
while (cur < end - len)
{
if (*cur == pattern[i])
{
if (++i == len)
return base;
cur++;
}
else
{
cur = ++base;
i = 0;
}
}
return NULL;
}
void detourFunction(void *addr, void *hook)
{
DWORD oldProt;
VirtualProtect(addr, 7, PAGE_EXECUTE_READWRITE, &oldProt);
*(BYTE *)addr = 0xB8;
*(DWORD *)(addr + 1) = (DWORD)(hook);
*(WORD *)(addr + 5) = 0xE0FF;
VirtualProtect(addr, 7, oldProt, NULL);
}