C++ Jump Hooks [Windows] - c++

Question

Well, i want to learn about hooking, but it seems that the tutorials found on the internet won't run.
What i want to do is a jump hook, in C++.
Here's the code :
void DoHook(DWORD* Address, DWORD* Hook, DWORD pid){
HANDLE Server = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ , false, pid );
Address = (DWORD*)Address + 0x18;
DWORD OldProt;
DWORD HookOffset = (DWORD*)Hook-(DWORD*)Address-5;
std::wcout << "Hook on address" << std::hex << Address<< std::endl;
std::wcout << "Hook offset is " << std::hex << HookOffset << std::endl;
if ( ! VirtualProtectEx(Server, (LPVOID) Address, 40,PAGE_EXECUTE_READWRITE, &OldProt) ) {
ErrorExit(L"VirtualProtectEx");
};
char* CharPointer = (char*) Address;
BYTE newdata[5]={0xE9};
BYTE x;
int i = 1;
while ( HookOffset > 0 ) {
x = HookOffset & 0xff;
newdata[5-i] = x;
i++;
HookOffset >>= 8;
}
std::wcout << "Bytes " <<newdata[0] << " " << newdata[1] << " " << newdata[2] << " " << newdata[3] << " " << newdata[4] << std::endl;
DWORD newdatasize = sizeof(newdata);
if ( ! WriteProcessMemory(Server,Address,(LPCVOID*)newdata,newdatasize,NULL) ) {
ErrorExit(L"WriteProcessMemory");
}
// VirtualProtect((void*) Address, 40, 0x40, &OldProt);
return;
}
Here's some output text :
Process ID is 2764 // PID of the app that's being hooked
Function address is 00A81190 // this is the function i'm doing the jump to
Entry point is 00080000 // for the app that's being hooked
Hook on address 00080060 // for the app that's being hooked
Hook offset is 28048e // HookAddress - FunctionAddress - 5
Bytes e9 0 28 4 8e // this is the jump i'm planning to do
Press any key to continue . . .
However, the application doesn't update.

Answer 1

You must run your program as administrator to have correct permissions to write to process memory. Here is my x86 detour function which I have tested and used many times
bool Detour32(char* src, char* dst, const intptr_t len)
{
if (len < 5) return false;
DWORD curProtection;
VirtualProtect(src, len, PAGE_EXECUTE_READWRITE, &curProtection);
intptr_t relativeAddress = (intptr_t)(dst - (intptr_t)src) - 5;
*src = (char)'\xE9';
*(intptr_t*)((intptr_t)src + 1) = relativeAddress;
VirtualProtect(src, len, curProtection, &curProtection);
return true;
}
src is the address you want to place the hook, dst is the address where you want to jump to. len is the number of bytes you are going to destroy with your jmp. The jmp is 5 bytes so if you're destroying instructions which are more than 5 bytes, you need copy more than 5 of the "stolen bytes" into your destination to ensure they get executed.