Skip to content

Instantly share code, notes, and snippets.

@un4ckn0wl3z
Created August 19, 2025 08:52
Show Gist options
  • Save un4ckn0wl3z/f6e692dd9a6490029324dd620e2fd492 to your computer and use it in GitHub Desktop.
Save un4ckn0wl3z/f6e692dd9a6490029324dd620e2fd492 to your computer and use it in GitHub Desktop.
#include <stdio.h>
volatile int Add(int a, int b);
int main() {
getchar();
volatile int result = Add(4, 5);
printf("Result: %d", result);
return 0;
}
volatile int Add(int a, int b) {
return a + b;
}
----------------------------------------------------------------------------------------------
#include <windows.h>
#include <cstdint> // For int32_t
#include "MinHook.h"
#include <stdio.h>
// Explicitly define the function pointer type
using Add_t = int32_t(__cdecl*)(int32_t, int32_t); // Alternative to typedef for clarity
// Pointer to the original function
Add_t fpAdd = nullptr;
// Target function address (for cleanup)
LPVOID pTarget = nullptr;
// Log file handle
FILE* g_LogFile = nullptr;
// Helper function to log messages
void LogMessage(const char* format, ...)
{
if (!g_LogFile) return;
va_list args;
va_start(args, format);
vfprintf(g_LogFile, format, args);
va_end(args);
fprintf(g_LogFile, "\n");
fflush(g_LogFile);
}
// Hook function
int32_t __cdecl HookedAdd(int32_t a, int32_t b)
{
LogMessage("Add Hooked! Input: a=%d, b=%d", a, b);
// Call original function
int32_t result = fpAdd(a, b);
// Modify return value (example: add +100)
LogMessage("Original result: %d, Modified result: %d", result, result + 100);
return result + 100;
}
DWORD WINAPI MainThread(LPVOID lpParam)
{
// Initialize MinHook
MH_STATUS status = MH_Initialize();
if (status != MH_OK)
{
LogMessage("MH_Initialize failed with status: %d", status);
return 1;
}
// Get base of main module (exe where Add is located)
HMODULE hMod = GetModuleHandle(nullptr);
if (!hMod)
{
LogMessage("GetModuleHandle failed: %lu", GetLastError());
MH_Uninitialize();
return 1;
}
// Add RVA offset (0x117B0 from your disassembly)
pTarget = reinterpret_cast<uint8_t*>(hMod) + 0x117C0;
LogMessage("Target function address: %p", pTarget);
// Create hook
status = MH_CreateHook(pTarget, &HookedAdd, reinterpret_cast<LPVOID*>(&fpAdd));
if (status != MH_OK)
{
LogMessage("MH_CreateHook failed with status: %d", status);
MH_Uninitialize();
return 1;
}
// Enable hook
status = MH_EnableHook(pTarget);
if (status != MH_OK)
{
LogMessage("MH_EnableHook failed with status: %d", status);
MH_Uninitialize();
return 1;
}
LogMessage("Hook successfully installed for function at %p", pTarget);
return 0;
}
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
{
// Initialize log file
if (fopen_s(&g_LogFile, "hook_log.txt", "w") != 0)
{
g_LogFile = nullptr; // Disable logging if file creation fails
}
else
{
LogMessage("DLL_PROCESS_ATTACH: DLL loaded");
}
DisableThreadLibraryCalls(hModule);
// Create thread for hooking
HANDLE hThread = CreateThread(nullptr, 0, MainThread, nullptr, 0, nullptr);
if (!hThread)
{
LogMessage("CreateThread failed: %lu", GetLastError());
if (g_LogFile)
{
fclose(g_LogFile);
g_LogFile = nullptr;
}
return FALSE;
}
CloseHandle(hThread);
break;
}
case DLL_PROCESS_DETACH:
{
LogMessage("DLL_PROCESS_DETACH: DLL unloading");
// Disable and remove specific hook
if (pTarget)
{
MH_DisableHook(pTarget);
MH_RemoveHook(pTarget);
}
// Uninitialize MinHook
MH_Uninitialize();
// Close log file
if (g_LogFile)
{
fclose(g_LogFile);
g_LogFile = nullptr;
}
break;
}
}
return TRUE;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment