#include <windows.h>
#include <cstdio>
#include <tchar.h>
 
BOOL EATHook(LPCTSTR szDllName, LPCTSTR szFunName, LPVOID NewFun) {
        DWORD addr = 0;
        DWORD index = 0;
        DWORD dwProtect;
        SIZE_T dwWritten = 0;
        HMODULE hMod = LoadLibrary(szDllName);
        if (NULL == hMod)
                return(FALSE);
        PIMAGE_DOS_HEADER pDosHeader = (PIMAGE_DOS_HEADER)hMod;
        PIMAGE_OPTIONAL_HEADER pOptHeader = (PIMAGE_OPTIONAL_HEADER)((PBYTE)hMod + pDosHeader->e_lfanew + 24);
        PIMAGE_EXPORT_DIRECTORY pExpDes = (PIMAGE_EXPORT_DIRECTORY)((PBYTE)hMod + pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
        PULONG pAddressOfFunctions = (PULONG)((PBYTE)hMod + pExpDes->AddressOfFunctions);
        PULONG pAddressOfNames = (PULONG)((PBYTE)hMod + pExpDes->AddressOfNames);
        PUSHORT pAddressOfNameOrdinals = (PUSHORT)((PBYTE)hMod + pExpDes->AddressOfNameOrdinals);
 
        for (int i = 0; i < pExpDes->NumberOfNames; ++i) {
                index = pAddressOfNameOrdinals[i];
                LPCTSTR pFuncName = (LPTSTR)((PBYTE)hMod + pAddressOfNames[i]);
                if (!_tcscmp((LPCTSTR)pFuncName, szFunName)) {
                        addr = pAddressOfFunctions[index];
                        break;
                }
        }
        VirtualProtect(&pAddressOfFunctions[index], 0x1000, PAGE_READWRITE, &dwProtect);
        pAddressOfFunctions[index] = (DWORD)NewFun - (DWORD)hMod;
        WriteProcessMemory(GetCurrentProcess(), &pAddressOfFunctions[index], (LPCVOID)((LPDWORD)NewFun - (LPDWORD)hMod), 8, &dwWritten);
        VirtualProtect(&pAddressOfFunctions[index], 0x1000, dwProtect, &dwProtect);
 
        return(TRUE);
}
 
int WINAPI MyMessageBox(
        HWND    hWnd,
        LPCTSTR lpText,
        LPCTSTR lpCaption,
        UINT    uType
) {
        _tprintf("Hello, world!\n");
 
        return(0);
}
 
typedef int (WINAPI* LPFNMESSAGEBOX)(HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption, UINT uType);
 
int _tmain() {
        EATHook("USER32.dll", "MessageBoxA", MyMessageBox);
        HMODULE hDll = GetModuleHandle("USER32.dll");
        LPFNMESSAGEBOX lpMessageBox = (LPFNMESSAGEBOX)GetProcAddress(hDll, "MessageBoxA");
        if (NULL == lpMessageBox)
                return(-1);
        lpMessageBox(NULL, "Hello, EAT Hook", "Info", MB_OK);
 
        return(0);
}