Function Hooking via Dll Injection Negative Offset

Question

I have some code that hooks a function via dll injection. The code works fine but i'm a little perplexed as to how it works. The code needs to calculate the offset from the function that i'm going to hook to the hooked function. It works perfectly but i've noticed that sometimes the offset is positive and sometimes it's negative (e.g. m_hkFuncAddr < m_hkAddr). Sometimes my dll is loaded before the address i'm trying to hook and sometimes it is after (I check using a utility called vmmap if that means anything). Regardless, it will work. But if I reverse the two, it's a guaranteed crash, regardless of where my dll is placed.

dwhkRelative = (((DWORD)m_hkFuncAddr - (DWORD)m_hkAddr) - 5);

Why is it that when I reverse the two it crashes, but when it's a negative offset, it works fine? Thanks in advance!

Answer 1

The jmp instruction with opcode 0xE9 uses a 32bit signed integer as its parameter.

This parameter is added to the address of the instruction after the jmp instruction to calculate the final address. It is allowed to be negative which is the case when your hook address is less than your hooked function's address.

As to why swapping them around crashes - it calculates the wrong number. It would calculate What do I have to add to the hook address to get to the hooked function's address which is the other way round.