Выполнить перехват API вызова методом сплайсинга функции

BOOL WINAPI CloseHandle(HANDLE);

#include <iostream>
#include <cstdlib>
#include "helper.hpp"
 
BOOL WINAPI Hook(HANDLE hObject)
{
    typedef BOOL (WINAPI *functionType)(HANDLE);
    
    static HookHelper::JmpNear jmpToOriginal;
    jmpToOriginal.opcode = 0xe9;
    jmpToOriginal.address = resolveRelAddress(&jmpToOriginal, &CloseHandle);
 
    if (!HookHelper::changePageProtection(&jmpToOriginal, sizeof(jmpToOriginal), PAGE_EXECUTE_READ))
    {
        std::wcerr << L"Cannot change protection for execute" << std::endl;
        std::wcin.get();
        std::quick_exit(GetLastError());
    }
 
    std::wcout << L"CloseHandle was hooked!" << std::endl;
 
    // call code which placed by the &jmpToOriginal address and pass hObject as parameter
    return HookHelper::call<functionType>(&jmpToOriginal, hObject);
}
 
int _tmain(int argc, TCHAR** argv)
{
    UNUSED(argc);
    UNUSED(argv);
 
    HookHelper::JmpNear* hookingFunction = reinterpret_cast<HookHelper::JmpNear*>(&CloseHandle);
 
    if (!HookHelper::changePageProtection(hookingFunction, sizeof(hookingFunction), PAGE_EXECUTE_READWRITE))
    {
        std::wcerr << L"Cannot change protection for execute and write" << std::endl;
        std::wcin.get();
        std::quick_exit(GetLastError());
    }
 
    hookingFunction->opcode = 0xe9;
    hookingFunction->address = resolveExistingRelAddress(&Hook, hookingFunction);
 
    HANDLE fileHandle = CreateFile(TEXT("d:\\test.txt"), GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    CloseHandle(fileHandle);
 
    std::wcin.get();
}

#pragma once
#include <algorithm>
#include <utility>
#include <cstdint>
#include <windows.h>
#include <tchar.h>
 
#define UNUSED(x) (void)x
 
namespace HookHelper
{
//============================================================================================
#pragma pack(push, 1)
struct JmpNear
{
    std::uint8_t opcode;
    std::int32_t address;
};
#pragma pack(pop)
 
using byte = std::uint8_t;
 
namespace
{
/*
*   mov edi, edi
*   push ebp
*   mov ebp, esp
*/
byte x32StackFrameOpcodes[] = { 0x8b, 0xff, 0x55, 0x8b, 0xec };
}
 
bool x32IsHookableStartOfFunction(void* pOffset)
{
    byte* comparingPointer = reinterpret_cast<byte*>(pOffset);
    return std::equal(x32StackFrameOpcodes, x32StackFrameOpcodes + sizeof(x32StackFrameOpcodes), comparingPointer);
}
 
std::int32_t resolveRelAddress(void* from, void* to)
{
    std::int32_t address =
        reinterpret_cast<byte*>(from)
        - reinterpret_cast<byte*>(to) + 5;
 
    if (from < to)
    {
        address = -address;
    }
 
    return address;
}
 
std::int32_t resolveExistingRelAddress(void* from, void* to)
{
    std::int32_t address =
        reinterpret_cast<byte*>(from)
        - reinterpret_cast<byte*>(to) - 5;
 
    return address;
}
 
bool changePageProtection(void* pOffset, std::uint32_t size, DWORD protection)
{
    DWORD oldProtection = 0;
    return VirtualProtect(pOffset, size, protection, &oldProtection) == TRUE;
}
 
template<typename T>
struct ResultOf;
 
template<typename ReturnType, typename... Args>
struct ResultOf <ReturnType(Args...)>
{
    using type = ReturnType;
};
 
template<typename ReturnType, typename... Args>
struct ResultOf <ReturnType(*)(Args...)>
{
    using type = ReturnType;
};
 
template<typename ReturnType, typename... Args>
struct ResultOf <ReturnType(WINAPI*)(Args...)>
{
    using type = ReturnType;
};
 
template<typename ToCast, typename... Args>
typename ResultOf<ToCast>::type
call(void* callable, Args&&... args)
{
    return reinterpret_cast<ToCast>(callable)(std::forward<Args&&>(args)...);
}
 
//============================================================================================
} // namespace

if(instruction == jmp)
{
      // calculate address to the real start of function
}
else if(instruction == stackFrame)
{
    int sz = calculateBytesForNops();
    fill(&instruction, sz);
}

void* Create_Hook(BYTE *src, const BYTE *dst, const int len)
{
    BYTE *jmp;
    DWORD dwback;
    DWORD jumpto, newjump;
 
    VirtualProtect(src,len,PAGE_READWRITE,&dwback);
    if(src[0] == 0xE9)
    {
        jmp = (BYTE*)malloc(10);
        jumpto = (*(DWORD*)(src+1))+((DWORD)src)+5;
        newjump = (jumpto-(DWORD)(jmp+5));
        jmp[0] = 0xE9;
        *(DWORD*)(jmp+1) = newjump;
        jmp += 5;
        jmp[0] = 0xE9;
        *(DWORD*)(jmp+1) = (DWORD)(src-jmp);
    }
    else
    {
        jmp = (BYTE*)malloc(5+len);
        memcpy(jmp,src,len);
        jmp += len;
        jmp[0] = 0xE9;
        *(DWORD*)(jmp+1) = (DWORD)(src+len-jmp)-5;
    }
    src[0] = 0xE9;
    *(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
    for(int i = 5; i < len; i++)
        src[i] = 0x90;
    VirtualProtect(src,len,dwback,&dwback);
    return (jmp-len);
}

typedef BOOL (WINAPI* HookCloseHandle)(__in HANDLE);
HookCloseHandle pHookCloseHandle;
 
BOOL WINAPI myCloseHandle(__in HANDLE hObject)
{
    //ТРАЛЯЛЯ МАЖИК Твои извращения
    return pHookCloseHandle(hObject);//тут ты возвращаешь оригинал
}

pHookCloseHandle = (HookCloseHandle)Create_Hook(PBYTE(::CloseHandle), (BYTE*)myCloseHandle, 5);

DWORD AddressToCall = 0x002FFFFF;//адресс из твоего примера
_declspec( naked ) int yourHook()
{
    __asm
    {
        push eax 
            call AddressToCall //вызываем функцию, а не прыжок.
    }
}

DWORD AddressToChangeASM = 0x0;//адресс по которому меняем инструкцию
Create_Hook((BYTE*)AddressToChangeASM, (BYTE*)yourHook, 5); //где 5 - размер записи в байтах.