HOOK api ret address



include 'win32ax.inc'

use32

entry start

section '.text' code readable executable

start:

invoke loadlib,dll

invoke  getfunc,eax,   fuc

mov dword [funcaddress],eax

invoke VirtualProtect,dword [funcaddress],100,PAGE_EXECUTE_READWRITE,fuck

mov edi,dword [funcaddress]

sub edi,0x1

loop_sreach:

add edi,0x4

cmp dword[edi],0x90909090

jnz  loop_sreach

sub edi,0x3;here is ret xx

mov byte [edi],0xE9

mov eax,check

sub eax,edi

sub eax,0x5

mov dword [edi+0x1], eax

push NULL

push NULL

push NULL

push NULL

call dword [funcaddress]

invoke exit,NULL

check:

mov dword [esp+4],0x0

ret

section '.data' data writeable readable

retaddress dd 00

dll db "USER32.DLL",0

fuc db "MessageBoxA",0

fuck dd 00

funcaddress dd 00

section '.idata' import data readable

library kernel,'KERNEL32.DLL'

import kernel,exit,'ExitProcess',\

        loadlib,'LoadLibraryA',\

        getfunc,'GetProcAddress',\

VirtualProtect,'VirtualProtect'