Hot Patching Made Easy

// includes
#include "stdafx.h"
#include "Windows.h"

#include "Psapi.h"
#include "Dbghelp.h"

#define SZ_PROCESS_TOHOOK "MyProcess.exe"
#define countof(x) (sizeof(x)/sizeof((x)[0]))

// get the hot patch DLL path
void GetHotpatchPath(LPTSTR lpHotpatchPath, UINT nSize)
{
	if(NULL != lpHotpatchPath)
	{
		if(GetCurrentDirectory(nSize, lpHotpatchPath) > 0)
		{
			_tcscat_s(lpHotpatchPath, nSize, _T("\\MySubsystem.HP.dll"));
		}
	}
}

// get the process handle for MyProcess.exe
HANDLE GetProcessHandle()
{
	HANDLE hProcess = NULL;
	HMODULE hMod[1024];

    DWORD dwNeeded = 0;
    DWORD dwProcess[1024];

	// enumerate through all the processes
	if(EnumProcesses(dwProcess, sizeof(dwProcess), &dwNeeded))
	{
		TCHAR szProcName[2 * MAX_PATH + 1] = { 0 };
		UINT uProcesses = dwNeeded / sizeof(DWORD);

		// loop through all the processes
        for ( UINT uIndex = 0; uIndex < uProcesses; uIndex++ )
        {
			// open process
			hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE 
									| PROCESS_VM_READ, FALSE, dwProcess[uIndex]);

			if(NULL != hProcess)
			{
				// enumerate through the process module
				if(EnumProcessModules(hProcess, hMod, sizeof(hMod), &dwNeeded))
				{
					// get the process file name
					if (GetModuleFileNameEx( hProcess, hMod[0], szProcName, _countof(szProcName)))
					{
						// check if the process is matchin
						if(0 != strstr(szProcName, SZ_PROCESS_TOHOOK))
							return hProcess;
					}
				}
			}	
		}
	}

	return NULL;

}


int _tmain(int argc, _TCHAR* argv[])
{
	DWORD dwSize = 0;
	DWORD hLibModule = 0;

	PVOID  pAllocEx = 0;
	TCHAR szHPPath[MAX_PATH] = {0};

	HANDLE hThread = NULL;
	HANDLE hProcess = GetProcessHandle();
	HMODULE hKernel32 = ::GetModuleHandle("Kernel32");
	dwSize = countof(szHPPath);

	GetHotpatchPath(szHPPath, dwSize);

	pAllocEx = VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE);

	if(pAllocEx)
	{
		::WriteProcessMemory(hProcess, pAllocEx, (void*)szHPPath, dwSize,	NULL);

		hThread = ::CreateRemoteThread(hProcess, NULL, 0,	
						(LPTHREAD_START_ROUTINE) ::GetProcAddress(hKernel32,"LoadLibraryA"), 
						pAllocEx, 0, NULL );

		if(NULL != hThread)
		{
			::WaitForSingleObject( hThread, INFINITE );
			::GetExitCodeThread( hThread, &hLibModule );
			::CloseHandle( hThread );		
		}

		::VirtualFreeEx( hProcess, pAllocEx, dwSize, MEM_RELEASE );
	}

	return 0;
}