[Windows Mobile Development and Hacking General] amir:
I Write a dll to hook RIL.dll but i have a problem in this code.

I put a hook opcode to RIL_Dial Function adress by WriteProcessMemory but not work correctly.

please help me.

// The patching code that is declared in RilPatch() as an external
// module.
extern "C" void RilPatch();

// The offset of first code that should be transfered from Ril.dll
// to RilPatch().
int MainOpcodeOffset;

// This routine will be used for installing RilPatch().
BOOL InstallPatch()
{
DWORD Opcode, OperatedBytes;
int offBytes;

// Loading Ril.dll and getting lpRIL_Dial start address
HMODULE RilDllModule = LoadLibrary(L"Ril.Dll");
FARPROC lpRIL_Dial = GetProcAddress(RilDllModule,L"RIL_Dial");
// Trace and finding The first replacement part of RilPatch()
// for transfering opcode from Ril.dll to RilPatch().
Opcode = 0;
offBytes = 0;
while (Opcode != 0xE1A00000)
{
if (!ReadProcessMemory(GetCurrentProcess(),(DWORD *)((DWORD)RilPatch + offBytes), &Opcode,4,&OperatedBytes))
return FALSE;
offBytes += 4;
}
MainOpcodeOffset = offBytes - 4;
// Reading opcode that should be transfered.
if (!ReadProcessMemory(GetCurrentProcess(),(DWORD *)((DWORD)lpRIL_Dial + 4),&Opcode,4,&OperatedBytes))
return FALSE;
// Transfering opcode.
if (!WriteProcessMemory(GetCurrentProcess(),(DWORD *)RilPatch + MainOpcodeOffset,&Opcode,4,&OperatedBytes))
return FALSE;
// Calculating opcode for Jump from Ril.dll to RilPatch().
Opcode = ((((DWORD)RilPatch) - ((DWORD)lpRIL_Dial) - 8) >> 2) | 0xEA000000;
// Inserting Jump opcode in Ril.dll
if (!WriteProcessMemory(GetCurrentProcess(),(DWORD *)((DWORD)lpRIL_Dial + 4),&Opcode,4,&OperatedBytes))
return FALSE;
DWORD NewOpcode;
if (!ReadProcessMemory(GetCurrentProcess(),(DWORD *)((DWORD)lpRIL_Dial + 4),&NewOpcode,4,&OperatedBytes))
return FALSE;

/************ BIG PROPLEM ***************/
/************ BIG PROPLEM ***************/
/************ BIG PROPLEM ***************/
/************ BIG PROPLEM ***************/
/************ BIG PROPLEM ***************/

if(NewOpcode != Opcode)
MessageBeep(MB_ICONASTERISK);

// Trace and finding The second replacement part of RilPatch()
// for adding Jump opcode from RilPatch() to Ril.dll
Opcode = 0;
offBytes = 0;
while (Opcode != 0xE1A00000)
{
if (!ReadProcessMemory(GetCurrentProcess(),(DWORD *)((DWORD)RilPatch + offBytes),&Opcode,4,&OperatedBytes))
return FALSE;
offBytes += 4;
}
offBytes -= 4;
// Calculating opcode for Jump from RilPatch() to Ril.dll
Opcode = ((((DWORD)lpRIL_Dial) - ((DWORD)RilPatch) - 8) >> 2) | 0xEA000000;
// Inserting Jump opcode in RilPatch()
if (!WriteProcessMemory(GetCurrentProcess(),(DWORD *)RilPatch + offBytes,&Opcode,4,&OperatedBytes))
return FALSE;
return TRUE;
}

// This routine will be used for uninstalling RilPatch().
BOOL UninstallPatch()
{
DWORD Opcode, OperatedBytes;

// Loading Ril.dll and getting lpRIL_Dial start address
HMODULE RilDllModule = LoadLibrary(L"Ril.Dll");
FARPROC lpRIL_Dial = GetProcAddress(RilDllModule,L"RIL_Dial");
// getting opcode that injected in RilPatch()
if (!ReadProcessMemory(GetCurrentProcess(),(DWORD *)RilPatch + MainOpcodeOffset,&Opcode,4,&OperatedBytes))
return FALSE;
// restoring opcode in Ril.dll
if (!WriteProcessMemory(GetCurrentProcess(),(DWORD *)((DWORD)lpRIL_Dial + 4),&Opcode,4,&OperatedBytes))
return FALSE;
return TRUE;
}

BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH :
// Installing Patch on loading DLL
return InstallPatch();
case DLL_PROCESS_DETACH:
// Uninstalling Patch on unloading DLL
return UninstallPatch();
}
return TRUE;
}

[/code]