Can you please explain this to me a bit more, i am so not familiar with getting the address of a function in the method you showed , but anyway .. it seems that you are then making it point to an INT, then changing that INT , amongst many other things .. to me it really doesn't look like a detour if thats supposed to be what it is .. i'm confused
EDIT : Why do you get the address of LoadLibrary by using the word "LoadLibrary" in asm , its that easy? i've always known to call GetProcAddress to obtain this
FURTHER EDIT :
void SetPointer(DWORD *Address, DWORD *Hook)
{
*Address = (DWORD)Hook; //set the value that Address points to point at Hook.
return;
}
void SetHook()
{
_asm
{
lea eax, LoadLibrary;
mov CurrentPtr, eax;
}
}
SetPointer(CurrentPtr, (DWORD*)&LoadLibraryHook);
Is all saying really that you are doing this :
*LoadLibrary = (DWORD)&LoadLibraryHook;
My question : how is that one line enough to detour the LoadLibrary function .. really ??
EDIT : AFK reading the SCHiMs hooking tuts in the CA sectio
EDIT : AFter reading the guide , i take back most of what i said , it just didn't occur to me that such a pointer would be stored so simply in the .data section :S .. the only thing which i think is a little confusing to teh reader is treating that pointer, as a pointer to int, when in fact its a pointer to function, which means that the data it points to is the start of a function ..
Much appreciation for the knowledge, i learnt something today :P
Last thing! does this only work for staticly linked libraries?