[HaBo]

PUSH EBP
MOV EBP,ESP 
SUB ESP,8 
PUSH EBX 
MOV DWORD PTR SS:[EBP-8],ECX 
MOV EAX,DWORD PTR SS:[EBP+8]
MOV DWORD PTR SS:[EBP-4],EAX 
\MOV ECX,DWORD PTR SS:[EBP+C] 
MOV EDX,DWORD PTR SS:[EBP+C] 
SUB EDX,1 
MOV DWORD PTR SS:[EBP+C],EDX 
TEST ECX,ECX 
JE SHORT ****** 
MOV EAX,DWORD PTR SS:[EBP+10] 
MOV ECX,DWORD PTR DS:[EAX] 
SHR ECX,8 
MOV EDX,DWORD PTR SS:[EBP+10] 
MOV EAX,DWORD PTR DS:[EDX] 
AND EAX,0FF 
MOV EDX,DWORD PTR SS:[EBP-4] 
XOR EBX,EBX 
MOV BL,BYTE PTR DS:[EDX] 
XOR EAX,EBX 
MOV EDX,DWORD PTR SS:[EBP+14] 
XOR ECX,DWORD PTR DS:[EDX+EAX*4] 
MOV EAX,DWORD PTR SS:[EBP+10] 
MOV DWORD PTR DS:[EAX],ECX 
MOV ECX,DWORD PTR SS:[EBP-4] 
ADD ECX,1 
MOV DWORD PTR SS:[EBP-4],ECX 
\JMP SHORT ***** 
POP EBX 
MOV ESP,EBP 
POP EBP 
RETN 10

// function to calculate end place a jump i386 (JMP) 
// AT *from with destination address *to  
static void write_rel_jmp(void *to,void *from) 
{  
 *(BYTE *)(from)=0xE9; // assemble jump  
 *(DWORD *)((DWORD)(from)+1)=((DWORD)to-(DWORD)from)-5; // calc rel jmp  
}

PUSH EBP
MOV EBP,ESP 
SUB ESP,8

// detour hooking in a very simple! form ;)

#include <stdio.h>
#include <windows.h>

#define JMP_LEN 5
#define JMP_OPC 0xE9

// function to calculate end place a jump i386 (JMP)
// AT *from with destination address *to

static void write_rel_jmp(void *to,void *from)
{
 *(BYTE *)(from)=0xE9; // assemble jump
 *(DWORD *)((DWORD)(from)+1)=((DWORD)to-(DWORD)from)-5; // calc rel jmp 
}

// function for hooking via so called detours

static int detour_hook_func (void *func_addr, void *handler,void *gateway)
{
int c=0;
 

 // bytes to copy ==> length of push ebp, mov ebp,esp sub esp,8 !

 c=6;

 // save orig bytes
 memcpy(gateway,func_addr,c);
 
 // calc && place jmp from func_to_hook TO our handler function
 write_rel_jmp(handler,func_addr); 
 
 // at last place jmp at end of origbytes to orig_func_addr + disassed bytes
 write_rel_jmp((BYTE*)((int)func_addr+c),(BYTE*)((int)gateway+c)); 

 return(0);
}
 

// function to modify page write permissions
// set make_writable to TRUE for write_execute_read permission
// set make_writable to FALSE for restoring original protection

int protect_page(void *pageaddr,DWORD *old_prot,BOOL make_writeable)
{
MEMORY_BASIC_INFORMATION mbi;
DWORD tmp_prot;

 VirtualQuery(pageaddr,&mbi,sizeof(mbi));

 if (make_writeable == TRUE) // set PAGE_EXECUTE_READWRITE flags
  VirtualProtect(mbi.BaseAddress,mbi.RegionSize,PAGE_EXECUTE_READWRITE,old_prot);
 else                      // restore set page flags
  VirtualProtect(mbi.BaseAddress,mbi.RegionSize,*old_prot,&tmp_prot);

 return(0);
}

// our "gateway" where original instructions + linking jump are stored
// used to call original function

typedef int (*sub_stdcall)();

static BYTE g_gateway_for_testapi[30];

DWORD WINAPI testapi(int p1,int p2,int p3,int p4)
{
 printf("\n called testapi");
 return(1);
}

DWORD WINAPI testapi_detoured(int p1,int p2,int p3,int p4)
{
DWORD retval_of_testapi;
 
 printf("\n params of testapi: %d %d %d %d",p1,p2,p3,p4);
 retval_of_testapi=((sub_stdcall)g_gateway_for_testapi)(p1,p2,p3,p4);
 printf("\n testapi returned: %d ",retval_of_testapi);
}

int main(int argc,char *argv[])
{
 DWORD old_prot;
 
 protect_page(&testapi,old_prot,TRUE);
 detour_hook_func(&testapi,&testapi_detoured,&g_gateway_for_testapi);
 protect_page(&testapi,old_prot,FALSE);

 testapi(1,2,3,4);

 return(0);
}