1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46
|
#include<Windows.h>
typedef NTSTATUS (NTAPI *ZwResumeThreads)(IN HANDLE ThreadHandle, OUT PULONG SuspendCount);
ZwResumeThreads szOldStub;
int RedirectFunction()
{
MessageBox(0,L"Successfully Hooked",L"Success!",MB_OK);
return 0;
}
int NtHook(__in LPVOID TargetAddress, __in LPVOID RedirectAddress , __out LPVOID* OldStub)
{
if(TargetAddress == 0 || RedirectAddress == 0 || OldStub == 0) return 100;
DWORD szOldPriv = 0;
LPVOID tmpStub = VirtualAlloc(0,1024,MEM_RESERVE|MEM_TOP_DOWN|MEM_COMMIT,PAGE_EXECUTE_READWRITE);
if(VirtualProtect(TargetAddress,5,PAGE_EXECUTE_READWRITE,&szOldPriv) == 0) {
VirtualFree(tmpStub,0,MEM_RELEASE);
return 200;
}
*(BYTE*)(tmpStub) = 0xB8;
*(DWORD*)((LPBYTE)tmpStub + 1) = *(DWORD*)((LPBYTE)RedirectAddress + 1);
// PUSH <RETURN ADDR> | RET
*(BYTE*)((LPBYTE)tmpStub + 5) = 0x68;
*(DWORD*)((LPBYTE)tmpStub + 6) = (DWORD)( (LPBYTE)TargetAddress + 5 );
*(BYTE*)((LPBYTE)tmpStub + 10) = 0xC3;
*(BYTE*)(TargetAddress) = 0xE9; //Jump <Address>
*(DWORD*)((LPBYTE)TargetAddress+1) = ((DWORD) RedirectAddress - ((DWORD)TargetAddress + 5 ));
*OldStub = tmpStub;
return 0;
}
int main(){
ZwResumeThreads ZwThread = (ZwResumeThreads) GetProcAddress(GetModuleHandleW(L"ntdll"), "NtResumeThread");
ULONG szSuspenLong = 0;
szOldStub = 0;
NtHook(ZwThread,RedirectFunction,(LPVOID*)szOldStub);
ZwThread(((HANDLE)-2),&szSuspenLong);
}
|