Read this tutorial first
2
Simple hook without patching the DLL file.
1)First thing you will need to create a DLL.
2)You will need to read on these functions
- OpenProcess
- CloseHandle
- WriteProcessMemory
- ReadProcessMemory
- VirtualAllocEx
- CreateRemoteThread
- WaitForSingleObject
- GetExitCodeThread
- VirtualFreeEx
3)You would need to know some ASM + Debugging
Basic Hooking:
int iPid = FindProcess("GameServer.exe");
//open the process for read and write
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, true, iPid);
if(!hProcess){
//error could not open the process
return -1;
}
//allocate space for the code section(here will be your code)
DWORD dwMemCode =(DWORD) VirtualAllocEx(hProcess, NULL, 0x100, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READ);
if(!dwMemCode){
//error could not allocate memory
return -1;
}
//allocate space for the Data section(here will be your variables and strings)
DWORD dwMemData =(DWORD) VirtualAllocEx(hProcess, NULL, 0x100, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
if(!dwMemData){
//error could not allocate memory
return -1;
}
//writing the dll path to the process memory for your functon to find it
char sDllPath[] = "C:\\MyHook.dll";
if(!WriteProcessMemory(hProcess,(LPVOID)dwMemData, sDllPath ,strlen(sDllPath), NULL)){
printf("errot could not write to memory");
return -1;
}
//create a remote Thread that will run on the process
//the remote thread is the function LoadLibraryA and as parameter is the sDllPath in theprocess memory
HANDLE hRemoteThread = CreateRemoteThread(hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)LoadLibraryA,(LPVOID)dwMemData,NULL, NULL);
//wait till the thread finishes
DWORD dwRet = WaitForSingleObject(hRemoteThread, INFINITE);
if(dwRet){
// if anything other then WAIT_OBJECT_0 close app
return -1;
}
//get the return code of the function loaded in CreateRemoteThread(LoadLibraryA)
DWORD hLibModule;
if(!GetExitCodeThread(hRemoteThread, &hLibModule)){
return -1;
}
//check if it returned correct
if(!hLibModule){
//could not attach the dll hook to the process
//either you didn't give a good path to the Dll, etc
return 1;
}
//close the thread
CloseHandle(hRemoteThread);
//do other operations
//At app Closing
//free the memory
VirtualFreeEx(hProcess,(LPVOID) dwMemCode, 0, MEM_RELEASE);
VirtualFreeEx(hProcess,(LPVOID) dwMemData, 0, MEM_RELEASE);
//close the process
CloseHandle(hProcess); //Close Handle
