How unhook LdrLoadDll function?

[himitsu]

HOOK overwrites a few bytes, so what do you have to do to undo?

Save old content and write back.

[flashcoder]

Zitat von himitsu:

HOOK overwrites a few bytes, so what do you have to do to undo?

Save old content and write back.

How?

could be:

Code:

Unhook(@NewLdrLoadDll, GetProcAddress(GetModuleHandle('ntdll.dll'), 'LdrLoadDll'));

?

[himitsu]

Zitat:

pbyte(target)^ := $E9;

Assignments can also be read out.
variable := pbyte(target)^;

[flashcoder]

Zitat von himitsu:

Zitat:

pbyte(target)^ := $E9;

Assignments can also be read out.
variable := pbyte(target)^;

Like this:

Code:

procedure Unhook(hookedfunc, oldfunc: pointer);
var
  jmpto: DWORD;
  OldProtect: Cardinal;
begin
  jmpto := DWORD(oldfunc) - DWORD(hookedfunc) - 5;
  VirtualProtect(hookedfunc, 5, PAGE_EXECUTE_READWRITE, @OldProtect);
  hookedfunc := pbyte(oldfunc)^;
  pdword(DWORD(hookedfunc) + 1)^ := jmpto;
end;

Usage:

Code:

Unhook(@NewLdrLoadDll, GetProcAddress(GetModuleHandle('ntdll.dll'), 'LdrLoadDll'));

right?