Write A Jump At A Specific Address

[James Parsons]

Say I have an address of a function thanks to:

   HMODULE hMod = GetModuleHandle("kernel32.dll");
   void* fn = GetProcAddress(hMod, "Beep");

I want to write a JMP instruction to another address at this entry. How do I do this.

[tath]

JMP fn

[James Parsons]

no i want to override the call at address $xxxxxxxx with a jmp call. I wan to inject it in

[tath]

*((unsigned*)fn) = <opcode>;

where <opcode> is JMP opcode with valid address. Still, i dont think it is possible to write in DLL and you might get access violation error

[Computergeek01]

@ OP: It helps to know what you'er looking for. The technique you are looking for is called function hooking and the library you want to look into is the Detours library published by Microsoft: http://research.microsoft.com/en-us/projects/detours/

There are other methods, but most of those require some inline assembly and for obvious reasons they piss off UAC and most AV clients.

[13bSLyTq]

First you must unprotect the memory area using VirtualProtectEx() or VirtualProtect()

then use opcodes to assign JMP to a function, read my blog it has all this: http://codeempire.blogspot.co.uk/