title: How to hook an exe function?
body: <p>I need to get something from a program. And with the help of ollydbg and IDA, I found the "thing" I can get is in a function called <code>sub_HEXHEX</code>.</p>
  
  <p>Now I know how to hook a function from Dll like <code>DrawTextA</code> or other one.
  I need to get function address with</p>
  
  <pre><code>HMODULE hmod = LoadLibrary(L"User32.dll");
  GetProcAddress(hmod, "DrawTextA")
  </code></pre>
  
  <p>But when I need to hook this <code>sub_HEXHEX</code>, I confused. I can get that exe's HANDLE, I know the function's Address (that 0x00HEXHEX), but there's no <code>GetProcAddress</code> I can use. I tried use <code>HANDLE + 0x00HEXHEX</code> as function's address, but I think im wrong with 'offset' things.</p>
  
  <p>Here is what I did</p>
  
  <pre><code>DWORD dwPid = GetCurrentProcessId();  
  hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, dwPid);  
  OldA2ECB0 = (sub_A2ECB0)((HMODULE)hProcess + 0xA2ECB0);  
  pfOldA2ECB0 = (FARPROC)OldA2ECB0;
  </code></pre>
  
  <p>And sub_A2ECB0</p>
  
  <pre><code>typedef int(*sub_A2ECB0)(LPCSTR param1, int param2);
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/SOdUf.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/SOdUf.png" alt="Function in IDA"></a></p>
  
  <p>But pfOldA2ECB0 will be NULL.<br>
  My knowledge is poor with C++ and Win32 (English, too), so its toooooo difficult for me.</p>