//
// By 85
// PatchIAT LTFX
// elhacker.net
// etalking.com.ar
// 2013
//

#include<windows.h>
#include<stdio.h>

FARPROC (WINAPI* pGetProcAddress) ( HMODULE hModule, LPCSTR lpProcName );

typedef FARPROC (WINAPI* GetProcAddress_t) ( HMODULE hModule, LPCSTR lpProcName );

FARPROC WINAPI newGetProcAddress(HMODULE hModule, LPCSTR lpProcName)
{
	FARPROC nResult;
	nResult=pGetProcAddress(hModule, lpProcName);
	if (HIWORD(lpProcName))
	{
		if (!lstrcmp(lpProcName, "GetProcAddress"))
		{
			return (FARPROC) &newGetProcAddress;
		}
	}
	return nResult;
}

DWORD PatchIAT( DWORD pOrgFunction, DWORD pNewFunction )
{
	DWORD dwOldProtect;
	DWORD dwOldProtect2;
	DWORD pOldFunction = ((DWORD*)pOrgFunction)[0];

	VirtualProtect( reinterpret_cast< void * >( pOrgFunction ), sizeof( DWORD ), PAGE_EXECUTE_READWRITE, &dwOldProtect );
	((DWORD*)pOrgFunction)[0] = pNewFunction;
	VirtualProtect( reinterpret_cast< void * >( pOrgFunction ), sizeof( DWORD ), dwOldProtect, &dwOldProtect2 );
	return pOldFunction;
}

int main(){

	//400000+2004= GPA IAT ENTRY (En este programa x64core!, no lo modifiques!)
	DWORD dwGPA = (DWORD)(GetModuleHandle(NULL));
	dwGPA+=0x2004;

	// x64core lo quiere en ASM inline..
	__asm {
		mov ebx, dwGPA
		mov edx, [ebx]
		mov pGetProcAddress, edx
	}

//	pGetProcAddress = *(GetProcAddress_t*)dwGPA;// Ajam..

	printf("pGetProcAddress 0x%X\n\n",pGetProcAddress);
	printf("GetProcAddress antes 0x%X\n\n",*(DWORD*)dwGPA);
//	printf("GetProcAddress antes 0x%X\n\n",GetProcAddress);//No referenciar GPA antes del parche!

	// Parchear IAT
	PatchIAT( dwGPA, (DWORD)&newGetProcAddress );

	// Sin PatchIAT:
	//Desproteger
	//DWORD* pGPA=(DWORD*)0x00402004;//400000+2004= GPA IAT ENTRY
	//*pGPA=(DWORD)&newGetProcAddress;
	//Proteger

	printf("dwGPA 0x%X\n",dwGPA);
	printf("*dwGPA 0x%X\n",*(DWORD*)dwGPA);
	printf("GetProcAddress ahora 0x%X\n",GetProcAddress);
	printf("newGetProcAddress 0x%X\n",newGetProcAddress);
	system("pause");

	DWORD test = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"),"GetProcAddress");
	printf("test 0x%X\n",test);
	printf("GetProcAddress ahora 0x%X\n",GetProcAddress);
	system("pause");
	return 0;
}

//

/*	__asm {
		mov ebx, dwGPA
		mov edx, [ebx]
		mov pGetProcAddress, edx
	}*/

typedef FARPROC (WINAPI* GetProcAddress_t) ( HMODULE hModule, LPCSTR lpProcName );

pGetProcAddress = *(GetProcAddress_t*)dwGPA;