I have found this complete and easy example to test the function hook:


#include <Windows.h>
#include <iostream>

#include "detours.h"
#include "sigscan.h"

// this is the function that the program
// will jump to when sum() is called in the original program (testprogram.exe)

DWORD AddressOfSum = 0;
// template for the original function
typedef int(*sum)(int x, int y); 

int HookSum(int x, int y)
    // manipulate the arguments
    x += 500;
    y += 500;

    // we manipulate the arguments here and then
    // redirect the program to the original function

    std::cout << "your program has been hacked! " << std::endl;
    sum originalSum = (sum)AddressOfSum;
    return originalSum(x, y);

BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpReserved)
    // store the address of sum() in testprogram.exe here.

    if (dwReason == DLL_PROCESS_ATTACH)
        // We will use signature scanning to find the function that we want to hook
        // we will find the function in IDA pro and create a signature from it:

        SigScan Scanner;

        // testprogram.exe is the name of the main module in our target process
        AddressOfSum = Scanner.FindPattern("testprogram.exe", "\x55\x8B\xEC\x8B\x45\x08\x03\x45\x0C", "xxxxxxxxx");


        // this will hook the function
        DetourAttach(&(LPVOID&)AddressOfSum, &HookSum);

    else if (dwReason == DLL_PROCESS_DETACH)
        // unhook

        // this will hook the function
        DetourDetach(&(LPVOID&)AddressOfSum, &HookSum);

    return TRUE;

I have tried to inject this DLL to the "testprogram.exe" (without change nothing) using cheat engine, extreme inject, etc.. with the some result "failed to inject".

I need to change "xxxxxxxxx" before inject the DLL ?

Can you help me please ?

Best Regards

  • The code probably crashes somewhere. Are you sure the AddressOfSum isn't null?
    – morsisko
    Jul 12, 2020 at 17:52
  • thank you ! the problem was solved and dll was inject correctly and the function hook work. Last question: How I can patch the exe to take permanent the modify ? Jul 12, 2020 at 21:41
  • I think it won't be easy. Probably better idea would be to make proxy dll using one of the .dlls that the game loads during start procedure.
    – morsisko
    Jul 12, 2020 at 22:14
  • thank you ! Please confirm If I have understand: 1) First create a c++ dll empty project, compile and put on game folder. 2) Download ProxiFy codeproject.com/Articles/1179147/… 3) Select the dll empty project with ProxiFy that will create .def file that contain the definitions to include on my final dll. 4) Before compile my hook.dll (32 bit) include .def file in the linker. 5) Now my hook.dll will be called by the game. Is correct ? Jul 13, 2020 at 8:09
  • I have never used ProxiFy but the approach looks generally correct, in your proxy.dll you always call the original function from original.dll, but in one case you call your hook procedure from DllMain posted above (before calling the original function), it would be good idea to find a function from original.dll that is called only once at game start
    – morsisko
    Jul 13, 2020 at 11:06


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.