#pragma comment (lib, "opengl32.lib")
#pragma comment (lib, "GLUT32/glut32.lib")
#include <windows.h>
#include <math.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
 
#include "GLUT32/glut.h"
#include <gl\gl.h>
#include <gl\glu.h>
 
#include "texture.h"
 

// Opengl32 es APIENTRY
typedef void(__stdcall* t_glBegin)(GLenum);
typedef void(__stdcall* t_glBlendFunc)(GLenum, GLenum);
typedef void(__stdcall* t_glViewport)(GLint,GLint,GLsizei,GLsizei);
 
// Declaramos unos punteros que van a contener la dirección de las funciones OGL32 que usemos.
t_glBegin pOrig_glBegin = NULL;
t_glBlendFunc pOrig_glBlendFunc = NULL;
t_glViewport pOrig_glViewport = NULL;
 

int main(int argc, char **argv)
{
  SetConsoleTitle("glTest");
 
  int opc=0;
  while( 1){
 
		system("cls");
		printf("Bienvenido!\n");
		printf("1: Interceptar OPENGL32\n");
		printf("2: NO Interceptar OPENGL32\n");
		printf("3: Salir\n");
		scanf("%d",&opc);
 
		if(opc == 1||opc == 2||opc == 3) break;
  }
 
  if(opc==3) ExitProcess(45);
 
  if(opc==1) //Al cargar la DLL, esta instala el hook a GPA para poder interceptar OGL32
  {
	  if(!LoadLibrary("glhack1.dll")){
 
		  MessageBox(0,0,0,0);
		  ExitProcess(0);
	  }
  }
 
  printf("\n");
  printf("EXE: GPA 0x%X\n", GetProcAddress);
  printf("EXE: glBegin 0x%X\n", glBegin);
  if(GetModuleHandle("opengl32.dll"))
  {
	  pOrig_glBegin = (t_glBegin)GetProcAddress(GetModuleHandle("opengl32.dll"), "glBegin");
	  pOrig_glBlendFunc = (t_glBlendFunc)GetProcAddress(GetModuleHandle("opengl32.dll"), "glBlendFunc");
	  pOrig_glViewport = (t_glViewport)GetProcAddress(GetModuleHandle("opengl32.dll"), "glViewport");
	  printf("EXE: glBegin 0x%X\n", pOrig_glBegin);
	  printf("EXE: glBlendFunc 0x%X\n", pOrig_glBlendFunc);
	  printf("EXE: glViewport 0x%X\n", pOrig_glViewport);
  }
  else
  {
	  MessageBox(0,0,0,0);
	  ExitProcess(0);
	  return 0;
  }
 
  glutInit(&argc, argv);
  glutInitDisplayMode(GLUT_RGBA | GLUT_DOUBLE);
  glutInitWindowSize(450, 450);
  glutCreateWindow("glTest");
  // glutFullScreen();
  init(argv[1]);
  glutDisplayFunc(display);
  glutKeyboardFunc(key);
  glutReshapeFunc(reshape);
  glutIdleFunc(tick);
  glutMainLoop();
  return 0;             /* ANSI C requires main to return int. */
}
 
//
 

void bfunc(void)
{
  static int state;
  if (state ^= 1) 
  {
    pOrig_glBlendFunc(GL_SRC_ALPHA, GL_ONE_MINUS_SRC_ALPHA);
    glEnable(GL_BLEND);
  } else {
    glDisable(GL_BLEND);
  }
}
 

void bfunc(void)
{
  static int state;
  if (state ^= 1) 
  {
    pOrig_glBlendFunc(GL_SRC_ALPHA, GL_ONE_MINUS_SRC_ALPHA);
    glEnable(GL_BLEND);
  } else {
    glDisable(GL_BLEND);
  }
}
 

void display(void)
{
  glClear(GL_COLOR_BUFFER_BIT);
  glPushMatrix();
  glTranslatef(transx, transy, 0.f);
  glRotatef(rotx, 0., 1., 0.);
  glRotatef(roty, 1., 0., 0.);
  glScalef(scale, scale, 0.);
  pOrig_glBegin(GL_POLYGON);
  glTexCoord2f(0.0, 0.0);
  glVertex2f(-1.0, -1.0);
  glTexCoord2f(1.0, 0.0);
  glVertex2f(1.0, -1.0);
  glTexCoord2f(1.0, 1.0);
  glVertex2f(1.0, 1.0);
  glTexCoord2f(0.0, 1.0);
  glVertex2f(-1.0, 1.0);
  glEnd();
  glPopMatrix();
  glutSwapBuffers();
}
 

void reshape(int w, int h)
{
  pOrig_glViewport(-50, -50, w+120, h+120);
}
 

BOOL HookIAT(char* szModule, char* szFunc, DWORD dwOwn, DWORD& dwOrg)
{
    DWORD dwBase = (DWORD)GetModuleHandle(NULL);
    PIMAGE_DOS_HEADER pDosHdr = (PIMAGE_DOS_HEADER)dwBase;
    PIMAGE_NT_HEADERS pNTHdr = (PIMAGE_NT_HEADERS)(dwBase + pDosHdr->e_lfanew);
    DWORD ImportData = (DWORD)pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
    PIMAGE_IMPORT_DESCRIPTOR pImportD = (PIMAGE_IMPORT_DESCRIPTOR)(dwBase + ImportData);
    while(pImportD->Name != 0)
    {
		// CUIDADO! En estas estructuras se encuentran strings no terminadas en 0
		// por lo que STRCMP no sirve.
		// Un cambio fácil puede ser usar STRSTR que encuentra una cadena dentro de otra.
		//	if(!strcmp((char*)(dwBase + pImportD->Name), szModule))
        if(!strstr((char*)(dwBase + pImportD->Name), szModule))
            break;
        pImportD++;
    }
 
	//printf("pImportD->Name: %s\n",(char*)(dwBase + pImportD->Name));
	//system("pause");
    if(pImportD->Name == 0) return FALSE;
	//printf("pImportD->Name: 0x%X\n",pImportD->Name);
	//system("pause");
 
    PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)(dwBase + pImportD->FirstThunk);
    DWORD OrgFunc = (DWORD)GetProcAddress(GetModuleHandle(szModule), szFunc);
    while(pThunk->u1.Function != 0)
    {
        if(pThunk->u1.Function == (DWORD*)OrgFunc)
        {
            dwOrg = OrgFunc;
            DWORD dwOldProt = 0;
            VirtualProtect((void*)&pThunk->u1.Function, 4, PAGE_EXECUTE_READWRITE, &dwOldProt);
            pThunk->u1.Function = (DWORD*)dwOwn;
            VirtualProtect((void*)&pThunk->u1.Function, 4, dwOldProt, &dwOldProt);
            if(pThunk->u1.Function == (DWORD*)dwOwn)
                return TRUE;
            else
                return FALSE;
        }
        pThunk++;
    }
    return FALSE;
}

 
//
// By 85
// HookIAT (h1web, Thanks to Ashkbiz Danehkar)
// elhacker.net
// etalking.com.ar
// 2013
//
 
///////////////////////////////////////////////////////////////////////////////////////////////////////////
 
#define WIN32_LEAN_AND_MEAN
#include<windows.h>
#include<stdio.h>
#include<stdlib.h>
#include"opengl.h"
 
///////////////////////////////////////////////////////////////////////////////////////////////////////////
 
FARPROC (WINAPI* pGetProcAddress) ( HMODULE hModule, LPCSTR lpProcName );
 
//
FARPROC WINAPI newGetProcAddress(HMODULE hModule, LPCSTR lpProcName)
{
	FARPROC nResult;
	nResult=GetProcAddress(hModule, lpProcName);
	if (HIWORD(lpProcName))
	{
		if (!lstrcmp(lpProcName, "GetProcAddress"))
		{
			return (FARPROC) &newGetProcAddress;
		}
		else
		{
			CheckForOpenGlHook(&nResult, lpProcName);
        }
	}
	return nResult;
}
 
//
BOOL HookIAT(char* szModule, char* szFunc, DWORD dwOwn, DWORD& dwOrg)
{
     // Ya mostrado
}
 
//
bool WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)
{
	if (fdwReason==DLL_PROCESS_ATTACH) 
	{
		//printf("GetProcAddress 0x%X\n", GetProcAddress);// No refenciar GPA antes!
		if(!HookIAT("kernel32.dll","GetProcAddress",(DWORD)newGetProcAddress,
			(DWORD&)pGetProcAddress)){
 
			MessageBox(0,0,0,0);
			return (false);
		}
 
		printf("\n");
		printf("DLL: newGetProcAddress 0x%X\n", newGetProcAddress);
		printf("DLL: GetProcAddress 0x%X\n", GetProcAddress);
		printf("DLL: pGetProcAddress 0x%X\n", pGetProcAddress);
 
	}
	return (true);
}
 

//
// By 85
// elhacker.net
// etalking.com.ar
// 2013
//
 
///////////////////////////////////////////////////////////////////////////////////////////////////////////
 
#pragma comment(lib, "opengl32.lib")
#include<windows.h>
#include<stdio.h>
#include "opengl.h"
 
///////////////////////////////////////////////////////////////////////////////////////////////////////////
 
// Opengl32 es APIENTRY
typedef void(__stdcall* t_glBegin)(GLenum);
typedef void(__stdcall* t_glBlendFunc)(GLenum, GLenum);
typedef void(__stdcall* t_glViewport)(GLint,GLint,GLsizei,GLsizei);
 
t_glBegin pOrig_glBegin = NULL;
t_glBlendFunc pOrig_glBlendFunc = NULL;
t_glViewport pOrig_glViewport = NULL;
 
bool once=false;
bool oglSubtractive = false;
bool NewDimension = true;
 
int posx = 200;
int posy = 200;
int neww = 50;
int newh = 50;
 
//
void __stdcall HOOK_glBegin(GLenum mode)
{
	if(!once){
		once=true;
	}
 
	if (mode==GL_POLYGON)
	{
	    glClearColor(1.0, 1.0, 1.0, 1.0);
	    glColor3f(0, 0, 0);
	}
 
	(*pOrig_glBegin)(mode);
}
 
void __stdcall HOOK_glBlendFunc(GLenum sfactor, GLenum dfactor)
{
	if(oglSubtractive){
		glBlendFunc(GL_SRC_ALPHA,GL_ONE_MINUS_SRC_ALPHA);
 
	} else {
		glBlendFunc(sfactor,dfactor);
	}
}
 
void __stdcall HOOK_glViewport( GLint x,GLint y,GLsizei width,GLsizei height )
{
	if(NewDimension){
 
		(*pOrig_glViewport)(posx,posy,neww,newh);
	}
	else
	{
		(*pOrig_glViewport)(x,y,width,height);
	}
}
 
void CheckForOpenGlHook(FARPROC* pProc,LPCTSTR lpProcName)
{
	if (!strcmp(lpProcName,"glBegin"))
	{
		pOrig_glBegin = (t_glBegin)*pProc;
		*pProc = (FARPROC)&HOOK_glBegin;
	}
	else if(!strcmp(lpProcName,"glBlendFunc"))
	{
			pOrig_glBlendFunc = (t_glBlendFunc)*pProc;
			*pProc = (FARPROC)&HOOK_glBlendFunc;
	}
	else if(!strcmp(lpProcName,"glViewport"))
	{
			pOrig_glViewport = (t_glViewport)*pProc;
			*pProc = (FARPROC)&HOOK_glViewport;
	}
}
 

 
//
// By 85
// elhacker.net
// etalking.com.ar
// 2013
//
 
///////////////////
 
#include<windows.h>
#include<stdio.h>
 
//////////////////////
//////////////////////
 
DWORD dwPatchPlace = 0x00000000;
BYTE Opcode_JZ = 0x74;
 
///////////
////////////////////
 
void Target(){
 
	while(1){
 
 
#define MASTERNUM 85
		int master=0x99999997;
		char* ingreso = new char[256];
 
		system("cls");
		printf("Ingrese la llave maestra\n");
		scanf("%s", ingreso);
 
		if(!strcmpi(ingreso, new char[]= "key85\0")){
 
			master = 85;
		}
 
		delete []ingreso;
		if(master==MASTERNUM)
		{
			printf("FELICITACIONES! USTE HA INGRESADO\n");
			printf("\n");
			system("pause");
			break;
		}
 
		//	if(GetAsyncKeyState(VK_END)) break;// En otro hilo
		if(!strcmpi(ingreso, new char[]= "exit\0")) break;
	}
}
 
//
void Check()//Función que representa un método de seguridad
{
	if(*(PBYTE)dwPatchPlace != Opcode_JZ)
	{
		printf("0x%X\n",*(PBYTE)dwPatchPlace);
		printf("Memoria alterada!, se sale del programa..\n");
		printf("\n");
		system("pause");
		ExitProcess(45);
	}
}
 
/////////
 
int main(){
 
	SetConsoleTitle("Dummy");
 
	dwPatchPlace=(DWORD)GetModuleHandle(NULL);//Retorna la BaseAddress
 
	//Sumamos el offset obtenido del desensamblado
	dwPatchPlace+=0x00001000;
	dwPatchPlace+=0x6C;
 
	//Logs
 
	printf("LOG DE SEGURIDAD PRIMARIO:\n");
	printf("0x%X\n",(DWORD)GetModuleHandle(NULL));
	printf("0x%X\n",dwPatchPlace);
	printf("0x%X\n",*(PBYTE)dwPatchPlace);
	printf("\n");
	system("pause");
 
	//Llamamos a la función
	Target();
 
	printf("LOG DE SEGURIDAD SECUNDARIO:\n");
	printf("0x%X\n",(DWORD)GetModuleHandle(NULL));
	printf("0x%X\n",dwPatchPlace);
	printf("0x%X\n",*(PBYTE)dwPatchPlace);
	printf("\n");
	system("pause");
 
	//Se deja que las comprobaciones de seguridad sigan su curso
	Check();
 
	return 0;
}
 

 
//
// By 85
// GetModuleBase (googleada en 5 segundos XD)
// elhacker.net
// etalking.com.ar
// 2013
//
 
///////////////////
 
#include<windows.h>
#include<stdio.h>
#include<tlhelp32.h>
 
//////////////////////
 
HANDLE hProcess;   
HANDLE hModule;
DWORD dwPatchPlace = 0x00000000;
BYTE Opcode_JZ = 0x74;
BYTE Opcode_JNZ = 0x75;
BYTE pReaden;
 
///////////
 
VOID Patch() {
 
//	printf("0x%X\n",pReaden);
//	system("pause");
 
	if(!hProcess) return;
	if(pReaden!=Opcode_JZ) return;
 
	DWORD dwOldProtect;
    VirtualProtect( (LPVOID)dwPatchPlace, 
                    1, 
                    PAGE_EXECUTE_WRITECOPY, 
                    &dwOldProtect ); 
 
    WriteProcessMemory( hProcess, 
                        (LPVOID)dwPatchPlace, 
                        &Opcode_JNZ, 
                        1, 
                        NULL );
 
    VirtualProtect( (LPVOID)dwPatchPlace, 
                    1, 
                    dwOldProtect, 
                    &dwOldProtect ); 
} 
 
//
////////////////////
 
DWORD GetModuleBase(LPSTR lpModuleName, DWORD dwProcessId) 
{ 
   MODULEENTRY32 lpModuleEntry = {0}; 
   HANDLE hSnapShot = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwProcessId ); 
 
   if(!hSnapShot) 
      return NULL; 
   lpModuleEntry.dwSize = sizeof(lpModuleEntry); 
   BOOL bModule = Module32First( hSnapShot, &lpModuleEntry ); 
   while(bModule) 
   {
	   //printf("%s\n",lpModuleEntry.szModule);
      if(!strcmp( lpModuleEntry.szModule, lpModuleName ) ) 
      { 
         CloseHandle( hSnapShot ); 
         return (DWORD)lpModuleEntry.modBaseAddr; 
      } 
      bModule = Module32Next( hSnapShot, &lpModuleEntry ); 
   } 
   CloseHandle( hSnapShot ); 
   return NULL; 
} 
 
int main(){
 
	// We have to replace JZ with JNZ.
 
	//TODO: Obtener privilegios
	//
 
	char l_exe[] = {'d','u','m','m','y','.','e','x','e',0};
	char l_window[] = {'D','u','m','m','y',0};
	HWND hwnd;          
	hwnd = FindWindow(0, l_window);     
	if (!hwnd)     
	{         
		printf("Abre %s ahora.\n", l_exe);         
		while (1)       
		{            
			Sleep(1000);             
			hwnd = FindWindow(0, l_window);             
			if (hwnd) break; 
			if (GetAsyncKeyState(VK_END)>0) ExitProcess(45);
		}             
	}
 
	unsigned long pid;     
	GetWindowThreadProcessId( hwnd, &pid);     
//	hProcess=OpenProcess(PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_QUERY_INFORMATION,0,pid);
//	hProcess=OpenProcess(PROCESS_VM_WRITE|PROCESS_VM_OPERATION,0,pid);
	hProcess=OpenProcess(PROCESS_ALL_ACCESS,0,pid);
 
	HANDLE baseAddress = (HANDLE)GetModuleBase(l_exe, pid);
	if(!baseAddress)
	{
		printf("No se obtubo la baseAddress!\n");
		system("pause");
		ExitProcess(45);
	}
 
	//Lugar del parche
	dwPatchPlace=(DWORD)baseAddress;
	dwPatchPlace+=0x00001000;
	dwPatchPlace+=0x6C;
 
	//Logs
	printf("hProcess: 0x%X\n",hProcess);
	printf("pid: %d\n",pid);
	printf("dwPatchPlace: 0x%X\n",dwPatchPlace);
//	printf("0x%X\n",*(PBYTE)dwPatchPlace);//No se puede hacer esto para otro proceso
	if(ReadProcessMemory(hProcess,(void*)(dwPatchPlace),&pReaden,sizeof(pReaden),0))
	{
		printf("Lugar antes de parchear: 0x%X\n",pReaden);
	}
	else
		printf("ReadProcessMemory failed: %d\n",GetLastError());
 
	system("pause");
 
	//Se procede a parchear el proceso objetivo
	Patch();
 
	if(ReadProcessMemory(hProcess,(void*)(dwPatchPlace),&pReaden,sizeof(pReaden),0))
	{
		printf("Lugar luego de parchear: 0x%X\n",pReaden);
	}
	else
		printf("ReadProcessMemory failed: %d\n",GetLastError());
 
 
	CloseHandle(hProcess);
	system("pause");
	return 0;
}
 
//
 

printf("0x%X\n",*(PBYTE)dwPatchPlace);//No se puede hacer esto para otro proceso

 
//
// By 85
// elhacker.net
// etalking.com.ar
// boyscout_arg@hotmail.com
// 2013
//
 
#include<windows.h>
#include<stdio.h>
 
//
FARPROC (WINAPI* pGetProcAddress) ( HMODULE hModule, LPCSTR lpProcName );
 
typedef FARPROC (WINAPI* GetProcAddress_t) ( HMODULE hModule, LPCSTR lpProcName );
 
//
FARPROC WINAPI newGetProcAddress(HMODULE hModule, LPCSTR lpProcName)
{
	FARPROC nResult;
	nResult=pGetProcAddress(hModule, lpProcName);
	if (HIWORD(lpProcName))
	{
		if (!lstrcmp(lpProcName, "GetProcAddress"))
		{
			return (FARPROC) &newGetProcAddress;
		}
	}
	return nResult;
}
 
//
DWORD PatchEAT( DWORD pOrgFunction, DWORD pNewFunction )
{
	DWORD dwOldProtect;
	DWORD dwOldProtect2;
	DWORD pOldFunction = ((DWORD*)pOrgFunction)[0];
 
	VirtualProtect( reinterpret_cast< void * >( pOrgFunction ), sizeof( DWORD ), PAGE_EXECUTE_READWRITE, &dwOldProtect );
	((DWORD*)pOrgFunction)[0] = pNewFunction;
	VirtualProtect( reinterpret_cast< void * >( pOrgFunction ), sizeof( DWORD ), dwOldProtect, &dwOldProtect2 );
	return pOldFunction;
}
 
//
void PatchEatConInlineASM(){
 
	char* gpastr = "GetProcAddress";
	DWORD k32base = (DWORD)GetModuleHandle("kernel32.dll");
 
	// Logs
    DWORD peheader=0;
	DWORD rva_exports_dir=0;
	DWORD rva_exports_funcs=0;
	DWORD rva_exports_fnames=0;
	DWORD va_exports_fnames=0;
	DWORD va_eat=0;
	int savedeax;
	DWORD rEDX;
 
	__asm{
		mov ebx, k32base                      //EBX = kernel32.dll's base address
		mov edx,dword ptr ds:[ebx+3Ch]        //PE header
		mov peheader, edx
		mov edx,dword ptr ds:[edx+ebx+78h]    //EDX = kernel32.dll's export directory (RVA)
		mov rva_exports_dir, edx
		mov eax,dword ptr ds:[edx+ebx+1Ch]    //Address of exported funcs (EAX = EAT (RVA))
		mov rva_exports_funcs, eax
		mov edx,dword ptr ds:[edx+ebx+20h]    //EDX = Address of function names (RVA)
		mov rva_exports_fnames, edx
		add edx,ebx                           //EDX = Address of function names (VA)
		mov va_exports_fnames, edx
		add eax,ebx                           //EAX = EAT (VA)
		mov va_eat, eax
	}
 
	__asm{
 
	get_exports:
		xor ecx, ecx
		mov esi,gpastr              //Address of string "GetProcAddress" (not null-terminated)
		mov edi,dword ptr ds:[edx]  //EDI = *(EDX = VA of function names)
		add edi,ebx                 //Address of string (Exported function name) (k32+offs en edi)
		mov cl,0Eh                  //14 chars
		repe cmpsb                  //recibe dos direcciones de 2 strings (ESI,EDI)
		je short found_set_context  //Jump if this is our function
		add edx,4                   //Next function name
		add eax,4                   //Next function address
		jmp short get_exports
	found_set_context:
		mov savedeax, eax
		mov edx,dword ptr ds:[eax]
		add edx,ebx  
		mov rEDX, edx
	}
 
 
	printf("k32 0x%X\n",k32base);
	printf("peheader 0x%X\n",peheader);
	printf("rva_exports_dir 0x%X\n",rva_exports_dir);
	printf("rva_exports_funcs 0x%X\n",rva_exports_funcs);
	printf("rva_exports_fnames 0x%X\n",rva_exports_fnames);
	printf("va_exports_fnames 0x%X\n",va_exports_fnames);
	printf("va_eat 0x%X\n",va_eat);
	printf("primer entrada de va_eat 0x%X\n",*(DWORD*)va_eat);//da un rva
	printf("savedeax 0x%X\n",savedeax);// eat entry para gpa
	printf("savedeax 0x%X\n",*(DWORD*)savedeax);// el rva en el eat entry correspondiente a gpa
	printf("GetProcAddress 0x%X\n",GetProcAddress);
	printf("rEDX 0x%X\n",rEDX);
	system("pause");
 
	/////////////////////////////////////////////////
 
	// Calcular el rva con mi gpa
	DWORD rvaMiGPA = (((DWORD)newGetProcAddress)-DWORD(k32base));
 
	// Inicializar puntero de retorno a la original
	pGetProcAddress = (GetProcAddress_t)rEDX;
 
	// Parche
	PatchEAT( savedeax, rvaMiGPA );// savedeax = eat entry para gpa
 
	printf("newGetProcAddress 0x%X\n",newGetProcAddress);
//	printf("GetProcAddress 0x%X\n",GetProcAddress);
	system("pause");
}
 
//
void PatchEatSinInlineASM(){
 
	DWORD k32base = (DWORD)GetModuleHandle("kernel32.dll");
	DWORD exports = k32base+0x262C;
	DWORD* dwEAT = (DWORD*)(exports+0x28);//953 entradas
	printf("EAT 0x%X\n",dwEAT);
 
	//for(int i=0;i<409-1;i++) dwEAT+=0x1;
	//printf("GPA EAT 0x%X\n",dwEAT);
	//printf("*GPA EAT 0x%X\n",*(dwEAT));
 
	DWORD dwEATgpa = (DWORD)(dwEAT+0x198);
	printf("GPA EAT 0x%X\n",(dwEAT+0x198));//0x199 = 409
	printf("*GPA EAT 0x%X\n",*(dwEAT+0x198));
 
	DWORD rvaGPA = dwEAT[409-1];//409 = gpa index
	DWORD dwGPA = k32base+rvaGPA;
 
	printf("rvaGPA 0x%X\n",rvaGPA);
	printf("dwGPA 0x%X\n",dwGPA);
//	printf("GetProcAddress 0x%X\n",GetProcAddress);
	//system("pause");
 
	/////////////////////////////////////////////////
 
	// Calcular el rva de mi gpa
	DWORD rvaMiGPA = (((DWORD)newGetProcAddress)-DWORD(k32base));
 
	printf("dwEATgpa 0x%X\n",dwEATgpa);
	printf("rvaMiGPA 0x%X\n",rvaMiGPA);
 
	// Inicializar puntero de retorno a la original
	pGetProcAddress = (GetProcAddress_t)dwGPA;
 
	// Parche
	PatchEAT( dwEATgpa, rvaMiGPA );
 
	printf("newGetProcAddress 0x%X\n",newGetProcAddress);
//	printf("GetProcAddress 0x%X\n",GetProcAddress);
	system("pause");
}
 
//
int main(){
 
	// 1
//	PatchEatConInlineASM();
 
	// 2
	PatchEatSinInlineASM();
 
	/////////////////////////////////////////////////
	// Test
 
	DWORD test = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
	printf("test 0x%X\n",test);
	printf("pGetProcAddress 0x%X\n",pGetProcAddress);// retorno a la original
 
	system("pause");
	return 0;
}
 
//
 

//
// By 85
// PatchEAT, PatchIAT (Googleadas en 5 segundos XD)
// elhacker.net
// etalking.com.ar
// 2013
//
 
#include<windows.h>
#include<stdio.h>
 
//
FARPROC (WINAPI* pGetProcAddress) ( HMODULE hModule, LPCSTR lpProcName );
 
typedef FARPROC (WINAPI* GetProcAddress_t) ( HMODULE hModule, LPCSTR lpProcName );
 
//
FARPROC WINAPI newGetProcAddress(HMODULE hModule, LPCSTR lpProcName)
{
	FARPROC nResult;
	nResult=pGetProcAddress(hModule, lpProcName);
	if (HIWORD(lpProcName))
	{
		if (!lstrcmp(lpProcName, "GetProcAddress"))
		{
			return (FARPROC) &newGetProcAddress;
		}
	}
	return nResult;
}
 
//
bool PatchEAT(HMODULE hTargetMod,CHAR* FuncName,VOID* newAdd,VOID** OrigAdd)
{
 
#define _sword sizeof(WORD) //AddressOfNameOrdinals
#define _sdword sizeof(DWORD)
    DWORD addEAT,beforeProtection;
    IMAGE_DOS_HEADER* dos_header=(IMAGE_DOS_HEADER*)hTargetMod;
    IMAGE_NT_HEADERS* nt_header=NULL;
    if(dos_header->e_magic!=IMAGE_DOS_SIGNATURE)
		return false;
 
	nt_header=((PIMAGE_NT_HEADERS)((DWORD)(dos_header)+(DWORD)(dos_header->e_lfanew)));
	if(nt_header->Signature!=IMAGE_NT_SIGNATURE)
		return false;
 
    addEAT=nt_header->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
    IMAGE_EXPORT_DIRECTORY* pEAT=(IMAGE_EXPORT_DIRECTORY*)((DWORD)addEAT+(DWORD)hTargetMod);
    for(DWORD i=0;i<pEAT->NumberOfFunctions;i++){
        DWORD* pName=(DWORD*)((DWORD)hTargetMod+((DWORD)pEAT->AddressOfNames+(_sdword*i)));
		//printf("add nombre 0x%X\n",pName);
		//system("pause");
        if(strcmp((char*)((DWORD)hTargetMod+*pName),FuncName) == 0){
            WORD* AddNamePtrs=(WORD*)((DWORD)hTargetMod+((DWORD)pEAT->AddressOfNameOrdinals+(i*_sword)));
            DWORD* AddFuncRVA=(DWORD*)((DWORD)hTargetMod+((DWORD)pEAT->AddressOfFunctions+(_sdword**AddNamePtrs)));
 
 
			//if(!strcmp((char*)((DWORD)hTargetMod+*pName),"GetProcAddress")){
			//printf("AddNamePtrs 0x%X\n",AddNamePtrs);
			//	printf("Add de la func rva 0x%X\n",AddFuncRVA);
			//	printf("Add func 0x%X\n",*AddFuncRVA+DWORD(hTargetMod));
			//	system("pause");
			//}
 
			if(!VirtualProtect(AddFuncRVA,_sdword,PAGE_READWRITE,&beforeProtection))
				return false;
 
			*OrigAdd=(void*)(*AddFuncRVA+DWORD(hTargetMod));
            *AddFuncRVA=(((DWORD)newAdd)-DWORD(hTargetMod));//copia el nuevo rva
            if(!VirtualProtect(AddFuncRVA,_sdword,beforeProtection,&beforeProtection))
				return false;
 
			break;
        }
    }
    return true;
}
 
//
BOOL PatchIAT(HMODULE ModHandle, DWORD OriginalFunc, DWORD HookFunc, void **pOriginalFunc)
{
	DWORD pe_offset,CurAddr,CurPointer,IATanfang,IATende,base;
	BOOL Hooked=FALSE;
	IMAGE_NT_HEADERS *pehdr;
 
	if(!ModHandle || !OriginalFunc || !HookFunc)
		return FALSE;
 
	base=(DWORD)ModHandle;
 
	memcpy(&pe_offset,(void *)(base+0x3C),sizeof(DWORD));
	pehdr=(IMAGE_NT_HEADERS *)((DWORD)base + pe_offset);
 
	IATanfang=(DWORD)base+pehdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].VirtualAddress;
	IATende=IATanfang+pehdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IAT].Size;
 
	CurAddr=IATanfang;
 
	while(CurAddr<IATende)
	{
		memcpy(&CurPointer,(void *)CurAddr,sizeof(DWORD));
 
		if(CurPointer==OriginalFunc)
		{
			if(pOriginalFunc)
				*pOriginalFunc=(PVOID)CurPointer;
			DWORD old_attributes,old_attributes2;
			if(!VirtualProtect((void *)CurAddr,sizeof(DWORD), PAGE_EXECUTE_READWRITE, &old_attributes))
				return FALSE;
			memcpy((void *)CurAddr,&HookFunc,sizeof(DWORD));
			if(!VirtualProtect((void *)CurAddr,sizeof(DWORD), old_attributes, &old_attributes2))
				return FALSE;
			Hooked=TRUE;
		}
 
		CurAddr+=sizeof(DWORD);
	}
	return Hooked;
}
 
//
int main(){
 
	/*DWORD test0a = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
	DWORD test0b = (DWORD)GetProcAddress(GetModuleHandle(NULL),"GetProcAddress");
	//printf("GPA original: 0x%X\n",pGetProcAddress);
	printf("GPA hook: 0x%X\n",newGetProcAddress);
	printf("GPA es ahora (k32): 0x%X\n",test0a);
	printf("GPA es ahora (EXE): 0x%X\n",test0b);
	system("pause");*/
	////////////////////////////////
 
	HINSTANCE lib;
	int Res=0;
	int hookmode=0;
	while( hookmode<1||hookmode>3){
 
		system("cls");
		printf("Bienvenido!\n");
		printf("Ingrese 1 para realizar un EAT HOOK\n");
		printf("Ingrese 2 para realizar un IAT HOOK\n");
		scanf("%d",&hookmode);
	}
 
	if(hookmode == 1) __asm jmp eathook;
	else if(hookmode == 2) __asm jmp iathook;
	else if(hookmode == 3) __asm jmp salida;
 
	/////////////////////////////////////////////////
	// EAT HOOK
 
eathook:
	Res = PatchEAT(GetModuleHandle("kernel32.dll"),"GetProcAddress",
		((VOID*)(&newGetProcAddress)),((VOID**)(&pGetProcAddress)));
 
	if(!Res){
 
		printf("No se ha modificado la EAT objetivo!\n");
		ExitProcess(0);
	}
 
	// Test 1
	DWORD test1a = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
	DWORD test1b = (DWORD)GetProcAddress(GetModuleHandle(NULL),"GetProcAddress");
	printf("GPA original: 0x%X\n",pGetProcAddress);
	printf("GPA hook: 0x%X\n",newGetProcAddress);
	printf("GPA es ahora (k32): 0x%X\n",test1a);
	printf("GPA es ahora (EXE): 0x%X\n",test1b);
	system("pause");
 
	lib = LoadLibrary("loaddll.dll");
	FreeLibrary(lib);
	return 0;
	//
 
	////////////////////////////////////////////////
	// IAT HOOK
 
iathook:
	Res = PatchIAT(GetModuleHandle(NULL),(DWORD)GetProcAddress,
		(DWORD)newGetProcAddress,(void **)&pGetProcAddress);
 
	if(!Res){
 
		printf("No se ha modificado la IAT objetivo!\n");
		ExitProcess(0);
	}
 
	// Test 2
	DWORD test2a = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
	DWORD test2b = (DWORD)GetProcAddress(GetModuleHandle(NULL),"GetProcAddress");
	printf("GPA original: 0x%X\n",pGetProcAddress);
	printf("GPA hook: 0x%X\n",newGetProcAddress);
	printf("GPA es ahora (k32): 0x%X\n",test2a);
	printf("GPA es ahora (EXE): 0x%X\n",test2b);
	system("pause");
 
	lib = LoadLibrary("loaddll.dll");
	FreeLibrary(lib);
	return 0;
	//
 
	/////////////////////////////////////////////////
	//
salida:
	return 0;
}
 
//
 

 
//
// By 85
// PatchEAT, PatchIAT (googleadas en 5 segundos XD)
// elhacker.net
// etalking.com.ar
// 2013
//
 
#include<windows.h>
#include<stdio.h>
 
//////////////////////////
 
BOOL APIENTRY DllMain(
HANDLE hModule,	// Handle to DLL module
	DWORD ul_reason_for_call,
	LPVOID lpReserved ) // Reserved
{
	switch ( ul_reason_for_call )
	{
		case DLL_PROCESS_ATTACH:
		// A process is loading the DLL.
 
			{
 
			DWORD res1 = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
			DWORD res2 = (DWORD)GetProcAddress(GetModuleHandle(NULL),"GetProcAddress");
			printf("GPA desde la dll mod=k32 0x%X\n", res1);
			printf("GPA desde la dll mod=EXE 0x%X\n", res2);
			system("pause");
			}
 
 
		break;
		case DLL_THREAD_ATTACH:
		// A process is creating a new thread.
		break;
		case DLL_THREAD_DETACH:
		// A thread exits normally.
		break;
		case DLL_PROCESS_DETACH:
		// A process unloads the DLL.
		break;
	}
	return TRUE;
}
 
////////////////
 

 
//
// By 85
// elhacker.net
// etalking.com.ar
// 2013
//
 
#include<windows.h>
#include<stdio.h>
 
//
int main(){
 
 
	HINSTANCE lib = LoadLibrary("loaddll2.dll");
	FreeLibrary(lib);
 
	printf("GPA original desde el EXE: 0x%X\n", GetProcAddress);
	system("pause");
	return 0;
}
 
//
 
 

 
//
// By 85
// PatchEAT, PatchIAT (googleadas en 5 segundos XD)
// elhacker.net
// etalking.com.ar
// 2013
//
 
#include<windows.h>
#include<stdio.h>
 
/////////////////////
 
FARPROC (WINAPI* pGetProcAddress) ( HMODULE hModule, LPCSTR lpProcName );
 
typedef FARPROC (WINAPI* GetProcAddress_t) ( HMODULE hModule, LPCSTR lpProcName );
 
//
FARPROC WINAPI newGetProcAddress(HMODULE hModule, LPCSTR lpProcName)
{
	FARPROC nResult;
//	nResult=pGetProcAddress(hModule, lpProcName);
	nResult=GetProcAddress(hModule, lpProcName);
	if (HIWORD(lpProcName))
	{
		if (!lstrcmp(lpProcName, "GetProcAddress"))
		{
			return (FARPROC) &newGetProcAddress;
		}
	}
	return nResult;
}
 
//
bool PatchEAT(HMODULE hTargetMod,CHAR* FuncName,VOID* newAdd,VOID** OrigAdd)
{
        // misma que el anterior programa
	...
}
 
//
BOOL PatchIAT(HMODULE ModHandle, DWORD OriginalFunc, DWORD HookFunc, void **pOriginalFunc)
{
	// misma que el anterior programa
	...
}
 
//
//////////////////////////
 
BOOL APIENTRY DllMain(
HANDLE hModule,	// Handle to DLL module
	DWORD ul_reason_for_call,
	LPVOID lpReserved ) // Reserved
{
	switch ( ul_reason_for_call )
	{
		case DLL_PROCESS_ATTACH:
		// A process is loading the DLL.
 
			{
				int Res=0;
				//
 
				//////////////////////////
				// EAT HOOK
 
		/*		Res = PatchEAT(GetModuleHandle("kernel32.dll"),"GetProcAddress",
				((VOID*)(&newGetProcAddress)),((VOID**)(&pGetProcAddress)));
 
				if(!Res){
 
					printf("No se ha modificado la EAT objetivo!\n");
					ExitProcess(0);
				}
 
				// Test 1
				DWORD test1a = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
				DWORD test1b = (DWORD)GetProcAddress(GetModuleHandle(NULL),"GetProcAddress");
				//DWORD test1b = (DWORD)GetProcAddress(GetModuleHandle("loaddll2.dll"),"GetProcAddress");//NO
				printf("DLL: GPA original: 0x%X\n",pGetProcAddress);
				printf("DLL: GPA original: 0x%X\n",GetProcAddress);
				printf("DLL: GPA hook: 0x%X\n",newGetProcAddress);
				printf("DLL: GPA es ahora (k32): 0x%X\n",test1a);
				printf("DLL: GPA es ahora (EXE): 0x%X\n",test1b);
				system("pause");*/
 
				/////////////////////////
				// IAT HOOK
 
 
				Res = PatchIAT(GetModuleHandle(NULL),(DWORD)GetProcAddress,
					(DWORD)newGetProcAddress,(void **)&pGetProcAddress);
 
				if(!Res){
 
					printf("No se ha modificado la IAT objetivo!\n");
					ExitProcess(0);
				}
 
				// Test 2
				DWORD test2a = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
				DWORD test2b = (DWORD)GetProcAddress(GetModuleHandle(NULL),"GetProcAddress");
				//DWORD test2b = (DWORD)GetProcAddress(GetModuleHandle("loaddll2.dll"),"GetProcAddress");//NO
				printf("DLL: GPA original: 0x%X\n",pGetProcAddress);
				printf("DLL: GPA original: 0x%X\n",GetProcAddress);
				printf("DLL: GPA hook: 0x%X\n",newGetProcAddress);
				printf("DLL: GPA es ahora (k32): 0x%X\n",test2a);
				printf("DLL: GPA es ahora (EXE): 0x%X\n",test2b);
				system("pause");
 
			}
 
 
		break;
		case DLL_THREAD_ATTACH:
		// A process is creating a new thread.
		break;
		case DLL_THREAD_DETACH:
		// A thread exits normally.
		break;
		case DLL_PROCESS_DETACH:
		// A process unloads the DLL.
		break;
	}
	return TRUE;
}
 
////////////////
 

if( 0 == 1){ /* no se cumple */ }

...
if(master==MASTERNUM)//Aquí es donde queremos entrar XD
		{ ...

 
//
// By 85
// Credits: Organner
// elhacker.net
// etalking.com.ar
// 2013
//
 
///////////////////
 
#include<windows.h>
#include<stdio.h>
 
//////////////////////
 
DWORD dwPatchPlace = 0x00000000;
BYTE Opcode_JZ = 0x74;
BYTE Opcode_JNZ = 0x75;
 
///////////
 
inline void Patch(){//Función de parcheadora
 
	if(*(PBYTE)dwPatchPlace!=Opcode_JZ) return;
 
	DWORD dwOldProtect;
    VirtualProtect( (LPVOID)dwPatchPlace, 
                    1, 
                    PAGE_EXECUTE_WRITECOPY, 
                    &dwOldProtect ); 
 
	WriteProcessMemory( GetCurrentProcess(), 
                        (LPVOID)dwPatchPlace, 
                        &Opcode_JNZ, 
                        1, 
                        NULL );
 
	 VirtualProtect( (LPVOID)dwPatchPlace, 
                    1, 
                    dwOldProtect, 
                    &dwOldProtect );
}
 
//
inline void UnPatch(){//Función restauradora
 
	if(*(PBYTE)dwPatchPlace!=Opcode_JNZ) return;
 
	DWORD dwOldProtect;
    VirtualProtect( (LPVOID)dwPatchPlace, 
                    1, 
                    PAGE_EXECUTE_WRITECOPY, 
                    &dwOldProtect ); 
 
	WriteProcessMemory( GetCurrentProcess(), 
                        (LPVOID)dwPatchPlace, 
                        &Opcode_JZ, 
                        1, 
                        NULL );
 
	 VirtualProtect( (LPVOID)dwPatchPlace, 
                    1, 
                    dwOldProtect, 
                    &dwOldProtect );
}
 
////////////////////
 
void Target(){//Función objetivo para ser alterada
 
	while(1){
 
#define MASTERNUM 85
		int master=0x99999997;
		char* ingreso = new char[256];
 
		system("cls");
		printf("Ingrese la llave maestra\n");
		scanf("%s", ingreso);
 
		if(!strcmpi(ingreso, new char[]= "key85\0")){
 
			master = 85;
		}
 
		delete []ingreso;
		if(master==MASTERNUM)//Aquí es donde queremos entrar XD
		{
			printf("FELICITACIONES! USTED HA INGRESADO\n");
			printf("\n");
			system("pause");
			break;
		}
 
		//	if(GetAsyncKeyState(VK_END)) break;// En otro hilo
		if(!strcmpi(ingreso, new char[]= "exit\0")) break;
	}
}
 
//
void Check()//Función que representa un método de seguridad
{
	if(*(PBYTE)dwPatchPlace != Opcode_JZ)
	{
		printf("0x%X\n",*(PBYTE)dwPatchPlace);
		printf("Memoria alterada!, se sale del programa..\n");
		printf("\n");
		system("pause");
		ExitProcess(45);
	}
}
 
/////////
 
int main(){
 
	// We have to replace JZ with JNZ.
 
	dwPatchPlace=(DWORD)GetModuleHandle(NULL);//Retorna la BaseAddress
 
	//Sumamos el offset obtenido del desensamblado
	dwPatchPlace+=0x00001000;
	dwPatchPlace+=0x6C;
 
	//Logs
	printf("0x%X\n",(DWORD)GetModuleHandle(NULL));
	printf("0x%X\n",dwPatchPlace);
	printf("0x%X\n",*(PBYTE)dwPatchPlace);
	printf("\n");
	system("pause");
 
	//Parcheamos la memoria antes de llamar a la función
	Patch();
 
	//Llamamos a la función objetivo
	Target();
 
	//Volvemos a dejar la memoria como estaba antes
//	UnPatch();
 
	//Se deja que las comprobaciones de seguridad sigan su curso normalmente
	Check();
 
	return 0;
}
 

*(PBYTE)dwPatchPlace= Opcode_JNZ;