Class 07 · KP 09 / 19

Inline Hook: Sketch

IAT hook: overwrite the import pointer so calls jump to your handler.

/* 64-bit absolute jmp = 12 bytes:
   mov rax, detour ; jmp rax  (or a 5-byte rel32 jmp) */
BYTE patch[12] = { 0x48,0xB8, /*imm64 detour*/, 0xFF,0xE0 };

/* 1. Save original prologue bytes -> trampoline (must copy WHOLE
      instructions; N >= patch size, respect instruction length). */
memcpy(trampoline, target, n_bytes_of_full_instrs);
/* 2. Append a jmp back to target+n so orig code continues. */
append_jmp(trampoline + n, target + n);
/* 3. Make target writable, install the jmp, restore protection. */
VirtualProtect(target, sizeof patch, PAGE_EXECUTE_READWRITE, &old);
memcpy(target, patch, sizeof patch);
VirtualProtect(target, sizeof patch, old, &old);
/* Now: call target -> detour; call trampoline -> real function. */

Gotchas: copy whole instructions (length disasm), fix RIP-relative operands, watch cross-thread races.