writeprocessmemory_hook.c

#include <stdio.h>
#include <windows.h>

#define BUFFER_FILE ".\\wpm_buffer.bin"

// definitions
typedef WINBOOL (WINAPI * WriteProcessMemory_) (HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten);

char OrgWriteProcMem[50] = {};

BOOL RestoreHook(LPVOID lpAddr, CHAR* OrgBytes);
BOOL PlaceHook(LPVOID lpAddr, PVOID lpHookAddr, CHAR* lpSaveBytes);

BOOL hWriteProcessMemory(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten)
{

    HANDLE hFile;
    DWORD BytesWritten;
    CHAR lpMessage[5000];

    hFile = CreateFile((LPCSTR)BUFFER_FILE, GENERIC_WRITE, 0, NULL, CREATE_NEW, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hFile == INVALID_HANDLE_VALUE)
    {
        MessageBox(NULL, "CreateFile: Failed to write buffer to file", NULL, 0);
        goto CALLFUNC;
    }

    if(!WriteFile(hFile, lpBuffer, nSize, &BytesWritten, NULL))
    {
        MessageBox(NULL, "WriteFile: Failed to write buffer to file", NULL, 0);
        goto CALLFUNC;
    }

    sprintf(lpMessage, "Detected WriteProcessMemory.\n\nStored buffer in %s (%d bytes)", BUFFER_FILE, BytesWritten);
    MessageBox(NULL, (LPCTSTR)lpMessage, "WriteProcessMemory", 0);

    goto CALLFUNC;

    CALLFUNC:
        // close the file handle
        CloseHandle(hFile);

        // restore the function
        LPVOID lpAddr = (LPVOID)GetProcAddress(GetModuleHandle("kernel32"), "WriteProcessMemory");
        RestoreHook(lpAddr, OrgWriteProcMem);

        // call the function
        WriteProcessMemory_  cWriteProcessMemory = (WriteProcessMemory_)GetProcAddress(GetModuleHandle("kernel32"), "WriteProcessMemory");
        BOOL bRet = cWriteProcessMemory(hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten);

        // place the hook back again
        PlaceHook(lpAddr, &hWriteProcessMemory, &OrgWriteProcMem);
        return bRet;
}

BOOL RestoreHook(LPVOID lpAddr, CHAR* OrgBytes)
{
    DWORD oldProtect, oldOldProtect;

    VirtualProtect(lpAddr, sizeof(OrgBytes), PAGE_EXECUTE_READWRITE, &oldProtect);
    memcpy(lpAddr, OrgBytes, sizeof(OrgBytes));
    VirtualProtect(lpAddr, sizeof(OrgBytes), oldProtect, &oldProtect);

    return TRUE;
}

BOOL PlaceHook(LPVOID lpAddr, PVOID lpHookAddr, CHAR* lpSaveBytes)
{
    DWORD oldProtect, oldOldProtect;

    // save the bytes
    memcpy(lpSaveBytes, lpAddr, 50);

    // our trampoline
    unsigned char boing[] = { 0x49, 0xbb, 0xde, 0xad, 0xc0, 0xde, 0xde, 0xad, 0xc0, 0xde, 0x41, 0xff, 0xe3 };

    // add in the address of our hook
    *(void **)(boing + 2) = lpHookAddr;

    // write the hook
    VirtualProtect(lpAddr, 13, PAGE_EXECUTE_READWRITE, &oldProtect);
    memcpy(lpAddr, boing, sizeof(boing));
    VirtualProtect(lpAddr, 13, oldProtect, &oldProtect);

    return TRUE;
}

DWORD DoHooking()
{
    // hook WriteProcessMemory
    LPVOID lpAddr = (LPVOID)GetProcAddress(GetModuleHandle("kernel32"), "WriteProcessMemory");
    PlaceHook(lpAddr, &hWriteProcessMemory, &OrgWriteProcMem);
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)
{
    switch( fdwReason )
    {
        case DLL_PROCESS_ATTACH:
            DoHooking();
    }
}