#include #include BOOL __stdcall MyGetCurrentProcess ( ) { std :: cout << "i have intercepted \n" ; return TRUE; } //----< call interception code >---- BOOL InterceptAPI ( HMODULE hModule, const char* pccDllName, /* targeting this system dll */ const char* pccApiName, /* this is the call to be intercepted */ DWORD dwReplaced /* replacement function */ ) { DWORD dwOldProtect ; DWORD dwAddressToIntercept = (DWORD) GetProcAddress ( GetModuleHandle( (char*)pccDllName ), (char*) pccApiName ) ; BYTE * pbTargetCode = (BYTE *) dwAddressToIntercept; BYTE * pbReplaced = (BYTE *) dwReplaced; /* to modify, change the protection level */ // Do we need administrator privileges ?? //////////////////////////////////////////// // why is this not working ?? VirtualProtect ( (void *) dwAddressToIntercept, 5, PAGE_WRITECOPY, /* open this for writing */ & dwOldProtect /* save the old state */ ) ; * pbTargetCode++ = 0xE9 ; /* relative jump */ * ((signed int *)(pbTargetCode)) = pbReplaced - (pbTargetCode + 4 ) ; /* set back old protection state */ /////////////////////////////////// VirtualProtect ( (void *) dwAddressToIntercept, 5, PAGE_EXECUTE, & dwOldProtect ) ; /* flush the cache and return */ //////////////////////////////// FlushInstructionCache ( GetCurrentProcess(), NULL, NULL ) ; return TRUE ; } //----< Dll Entry Point >---- BOOL __stdcall DllMain (HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) { switch ( fdwReason ) { if ( fdwReason == DLL_PROCESS_ATTACH ) { InterceptAPI ( hinstDLL, "kernel32.dll", /* targeting this system dll */ "GetCurrentProcess", /* this is the call to be intercepted */ (DWORD) MyGetCurrentProcess /* replacement function */ ) ; } else if ( fdwReason == DLL_PROCESS_DETACH ) { // Cleanup } } return TRUE; }