Foro de elhacker.net

#include <windows.h>
#include <stdio.h>

DWORD HookFunction(LPCSTR lpModule, LPCSTR lpFuncName, LPVOID lpFunction, unsigned char *lpBackup);
BOOL UnHookFunction(LPCSTR lpModule, LPCSTR lpFuncName, unsigned char *lpBackup);
void WINAPI Sleep_hooked(DWORD ms, unsigned int call_addr);
BYTE BackUp[6];

void WINAPI Sleep_hooked(DWORD ms, unsigned int call_addr)
{
    printf("Hooked :) -  ms: %d\n", ms);
    UnHookFunction("kernel32.dll", "Sleep", BackUp);
    Sleep(ms);
    HookFunction("kernel32.dll", "Sleep", (LPVOID)Sleep_hooked, BackUp);
}

DWORD HookFunction(LPCSTR lpModule, LPCSTR lpFuncName, LPVOID lpFunction, unsigned char *lpBackup)
{
	DWORD dwAddr = (DWORD)GetProcAddress(GetModuleHandle(lpModule), lpFuncName);
	BYTE jmp[6] = { 0xe9,
		0x00, 0x00, 0x00, 0x00,
		0xc3
	};
 
	ReadProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, lpBackup, 6, 0); 
 
	DWORD dwCalc = ((DWORD)lpFunction - dwAddr - 5);
 
	memcpy(&jmp[1], &dwCalc, 4);
 
	WriteProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, jmp, 6, 0);
 
	return dwAddr;
}
 
BOOL UnHookFunction(LPCSTR lpModule, LPCSTR lpFuncName, unsigned char *lpBackup) 
{
	DWORD dwAddr = (DWORD)GetProcAddress(GetModuleHandle(lpModule), lpFuncName);
 
	if (WriteProcessMemory(GetCurrentProcess(), (LPVOID)dwAddr, lpBackup, 6, 0)) 
		{
		return TRUE; 
	}
	return FALSE; 
}

int main(void)
{
    HookFunction("kernel32.dll", "Sleep", (LPVOID)Sleep_hooked, BackUp);
    Sleep(1000);
    printf("test\n");
     Sleep(1500);
    printf("test2\n");
    UnHookFunction("kernel32.dll", "Sleep", BackUp);
}