title: API Hooking without Detours
body: <p><strong>Intro Info:</strong> Windows 7 64-bit. C++. 64-bit Apps and DLL's. Hooking without MS Detours.</p>
  
  <p><strong>Question:</strong> I've struggled on the issue of getting a working example that demonstrates hooking in Windows. Most of the tuts out there seem to have been written during a time where 32-bit Windows XP was the only operating system... I've since overcome the 64-bit hurdles of understanding and injected a DLL successfully. My next step in this journey of knowledge is hooking. 
      In keeping with the nostalgia of the topic, MS's Detours does not support 64-bit (for free) and I'm certainly not paying $10,000 for anything. So I pursued the conventional methods in <a href="http://www.codeproject.com/Articles/30140/API-Hooking-with-MS-Detours" rel="noreferrer">this tutorial</a>.</p>
  
  <p>This tut is awesome, but I'm having a little trouble understanding this segment:</p>
  
  <pre><code>void BeginRedirect(LPVOID newFunction)
  {
      BYTE tempJMP[SIZE] = {0xE9, 0x90, 0x90, 0x90, 0x90, 0xC3};
      memcpy(JMP, tempJMP, SIZE);
      DWORD JMPSize = ((DWORD)newFunction - (DWORD)pOrigMBAddress - 5);
      VirtualProtect((LPVOID)pOrigMBAddress, SIZE, 
                  PAGE_EXECUTE_READWRITE, &amp;oldProtect);
      memcpy(oldBytes, pOrigMBAddress, SIZE);
      memcpy(&amp;JMP[1], &amp;JMPSize, 4);
      memcpy(pOrigMBAddress, JMP, SIZE);
      VirtualProtect((LPVOID)pOrigMBAddress, SIZE, oldProtect, NULL);
  }
  </code></pre>
  
  <p>Particularly, I'm struggling with the tempJMP byte and all of the memcpy going on. I have an address for the InsertDate() function of Notepad that I want to hijack, but I'm not sure where to aim it... Would this be the address of the new function? Or is it not relative? Idk, I'm just looking for some pointers.</p>