So I'll answer my questions and then if I'm wrong please correct me.
1. Basically it always finds the address in the correct location every time. It's like a pointer.
2. Hooking means getting the original functions the game has and abusing them in order to make hacks.
Please explain it to me well.
Thanks in advance for all the responders.
Naw you're wrong for both, sorry. No big deal though. You aren't too far from the correct answer though.
1) Is actually formally referred to as a signature scanner. When an application is recompiled or relinked in to a portable executable image a little differently than the time before, the location of functions will be a little different than before. Sometimes you can simply just relink the object files without changing the config and the functions will end up at different locations. When this happens, the function to move a player might now be at 0x123, where as in the last release, it was at 0x456. Data memory addresses will be located at different addresses as well, etc... The fundemental flow of execution for all of these functions will likely remain the same unless junk-code is injected, or optimization\code-generation configurations are changed (and usually it isn't.) As such, all of these functions will have their opcodes remain relativley constant for each time the source code is compiled. If it is just a manner of relinking, the opcodes will probably be more or less exactly the same.
If the opcodes of a function are the same for every time the executable is compiled, we can create what is called a 'signature'; a series of bytes that the function will always be composed of and search for this signature in memory until we find the pattern. The address this signature is found at, will be inside of the function we are looking for.
2) Hooking or detouring function is redirecting traffic towards the function to another function to either log, or mutiliate arguments or other data passed or generated by the function (for mid-function detours.)
Most detours are placed at the prolouge (start of the function.) When the function is executed, control is passed over to the detour placed where the detour can change or log arguments. Then control is passed back to the original (it can also be ignored if the programmer of the detour desires.)
The actual implementation of a trampoline detour is quite simple. You replace the first instruction of the function with a jump to the detour, then you take the instructions which the jump replaced and move them over to an allocated executable region of code, and append a jump back to the original function following those opcodes. This enables the detour to call the original function and bypass the detour it placed.
There are other methods of implementing a detour, using software and hardware breakpoint, and following it up with a top-level exception handler. Same method is used, it is just that an exception handler is the medium for redirection.