Dll 내보내기 테이블 훅

#include "stdafx.h"
#include <windows.h>
#include <assert.h> 
#pragma comment(lib,"user32.lib")

typedef int (*detour_MessageBoxA)(HWND hWnd,LPCSTR,LPCSTR,UINT);
detour_MessageBoxA msg;
char origInstr[8] = {0};
char newInstr[8] = {"\xe9\x00\x00\x00\x00"};

int _tmain(int argc, _TCHAR* argv[])
{
	DWORD tmp;
	DWORD curr;
	char str[] = {""};
	char* funcName = NULL;
	HMODULE hMod = LoadLibrary("user32.dll");
	char* dllBase = (char*)hMod;
	IMAGE_DOS_HEADER *pDosHeader = (IMAGE_DOS_HEADER*)dllBase;    
    IMAGE_OPTIONAL_HEADER *pOptHeader = (IMAGE_OPTIONAL_HEADER*)((BYTE*)dllBase +  pDosHeader->e_lfanew + 24);  
    IMAGE_EXPORT_DIRECTORY *pExport = (IMAGE_EXPORT_DIRECTORY*)((BYTE*)dllBase + pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
	char* dllname = dllBase+pExport->Name;
	//     RVA，          RVA
	DWORD* funcNameRvaTab = (DWORD*)(dllBase+pExport->AddressOfNames);
	//   dllBase+pExport->AddressOfFunctions       
	WORD* funcOrdinalTab = (WORD*)(dllBase+pExport->AddressOfNameOrdinals);
	DWORD* exportFuncAddrTab = (DWORD*)(dllBase+pExport->AddressOfFunctions);
	DWORD NumberOfNames = pExport->NumberOfNames;
	DWORD idx;
	DWORD oldProct;
	for(idx=0;idx<NumberOfNames;idx++)
	{
		funcName = (char*)(dllBase+funcNameRvaTab[idx]);
		if(strcmp((const char*)funcName,"MessageBoxA")==0)
		{
			DWORD idxInFuncAddrArry = funcOrdinalTab[idx];
			//     dll      
			//exportFuncAddrTab[idxInFuncAddrArry]    RVA 
			msg = (detour_MessageBoxA)(dllBase + exportFuncAddrTab[idxInFuncAddrArry]);
#if 0
			//     msgBox,    checkEsp       _cdecl->stdcall
			(msg)(NULL,"","",MB_OK);
#endif			
			assert(VirtualProtect(msg,8,PAGE_EXECUTE_READWRITE,&oldProct)!=0);
			//save
			ReadProcessMemory(GetCurrentProcess(),msg,origInstr,8,&tmp);
			__asm
			{
				mov eax,Lab1;
				mov curr,eax;
			}
			//                  ，      Lab1
			//diff         jmp    
			DWORD diff = (DWORD)curr-(DWORD)msg-5;
			memcpy(newInstr+1,(char*)&diff,sizeof(DWORD));

			WriteProcessMemory(GetCurrentProcess(),msg,newInstr,5,&tmp);
			(msg)(NULL,"","",MB_OK);
		}
	}

	while(1)
	{
		Sleep(1);
	}

	//                      （       push ebp ）
	//          
Lab1:
	static int cnt=0;
	
	cnt++;
	WriteProcessMemory(GetCurrentProcess(),msg,origInstr,8,&tmp);
	__asm
	{
		mov eax,Lab2;
		mov curr,eax;
	}
	assert(VirtualProtect((DWORD*)curr,8,PAGE_EXECUTE_READWRITE,&oldProct)!=0);
	//   Lab2  msg       
	DWORD diff = (DWORD)msg-(DWORD)curr-5;
	__asm
	{
		mov ebx,diff;
		mov eax,Lab2;
		inc eax;
		mov [eax],ebx;
	}
Lab2:
	__asm
	{
		_emit 0xe9;
		_emit 0x00;
		_emit 0x00;
		_emit 0x00;
		_emit 0x00;
	}

	return 0;
}