_declspec (naked) void WINAPI create_file(LPCWSTR lpFileName,
DWORD dwDesiredAccess,
DWORD dwShareMode,
LPSECURITY_ATTRIBUTES lpSecurityAttributes,
DWORD dwCreationDisposition,
DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
{
_asm
{
nop
nop
nop
nop
nop
}
_asm
{
nop
nop
nop
nop
nop
}
}
void hook_create_file_w()
{
DWORD flag, flag2;
BYTE old_code[5];
BYTE jmp_in[] = { 0xe9, 0, 0, 0, 0 };
BYTE jmp_out[] = { 0xe9, 0, 0, 0, 0 };
g_old_create_file_w = (FARPROC)GetProcAddress(GetModuleHandleA("kernel32"), "CreateFileW");
*((DWORD*)(jmp_in + 1)) = (DWORD)create_file - (DWORD)g_old_create_file_w - 5;
*((DWORD*)(jmp_out + 1)) = (DWORD)g_old_create_file_w - (DWORD)create_file - 5;
VirtualProtectEx(GetCurrentProcess(), g_old_create_file_w, 5, PAGE_EXECUTE_READWRITE, &flag);
memcpy(old_code, g_old_create_file_w, 5);
WriteProcessMemory(GetCurrentProcess(), g_old_create_file_w, jmp_in, 5, NULL);
VirtualProtectEx(GetCurrentProcess(), g_old_create_file_w, 5, flag, &flag);
VirtualProtectEx(GetCurrentProcess(), create_file, 10, PAGE_EXECUTE_READWRITE, &flag2);
WriteProcessMemory(GetCurrentProcess(), create_file, old_code, 5, NULL);
WriteProcessMemory(GetCurrentProcess(), (void*)((DWORD)create_file+5), jmp_out, 5, NULL);
VirtualProtectEx(GetCurrentProcess(), create_file, 10, flag2, &flag2);
}
