替换汇编指令会更改其他指令

Question

I am trying to place a call instruction at a function to simulate a hook, so i should be replacing 6 bytes in the beginning of the function to place my call which is 2 bytes for the opcode and a dword for the address. however here is the disassembly of the function before i hook it

void realFunction()
{
00B533C0  push        ebp  
00B533C1  mov         ebp,esp  
00B533C3  sub         esp,0C0h  
00B533C9  push        ebx  
00B533CA  push        esi  
00B533CB  push        edi  
00B533CC  lea         edi,[ebp-0C0h]  
00B533D2  mov         ecx,30h  
00B533D7  mov         eax,0CCCCCCCCh  
00B533DC  rep stos    dword ptr es:[edi]  
    MessageBox(NULL, "realFunction()", "Trace", MB_OK);
00B533DE  mov         esi,esp  
00B533E0  push        0  
00B533E2  push        0B56488h  
00B533E7  push        0B56490h  
00B533EC  push        0  
00B533EE  call        dword ptr ds:[0B5613Ch]  
00B533F4  cmp         esi,esp  
00B533F6  call        _RTC_CheckEsp (0B53A10h)  
}

and strangely here is it after i just replace 6 bytes

void realFunction()
{
00B533C0  call        fakeFunction (0B52EF0h)  
00B533C5  rol         byte ptr [eax],0 <-- 
00B533C8  add         byte ptr [ebx+56h],dl <--
00B533CB  push        edi <--
00B533CC  lea         edi,[ebp-0C0h] <--
00B533D2  mov         ecx,30h  
00B533D7  mov         eax,0CCCCCCCCh  
00B533DC  rep stos    dword ptr es:[edi]  
    MessageBox(NULL, "realFunction()", "Trace", MB_OK);
00B533DE  mov         esi,esp  
00B533E0  push        0  
00B533E2  push        0B56488h  
00B533E7  push        0B56490h  
00B533EC  push        0  
00B533EE  call        dword ptr ds:[0B5613Ch]  
00B533F4  cmp         esi,esp  
00B533F6  call        _RTC_CheckEsp (0B53A10h)  
}

code for the hook

#include <iostream>
#include <windows.h>

using namespace std;

void realFunction()
{
    MessageBox(NULL, "realFunction()", "Trace", MB_OK);
}

__declspec(naked) void fakeFunction()
{
    __asm {
        pushad;
        pushfd;
    }

    MessageBox(NULL, "fakeFunction()", "Trace", MB_OK);

    __asm{
        popfd;
        popad;
        ret; //This should return back and resumes the execution of the original function;
    }
}

void main()
{
    DWORD size = sizeof(double);
    DWORD oldProtection;
    DWORD realFunctionAddr = (DWORD)realFunction;
    DWORD fakeFunctionAddr = (DWORD)fakeFunction;

    VirtualProtect((LPVOID)realFunctionAddr, size, PAGE_EXECUTE_READWRITE, &oldProtection);
    *((PBYTE)(realFunctionAddr)) = 0xE8;
    *((PDWORD)(realFunctionAddr + 1)) = fakeFunctionAddr - realFunctionAddr - 5;
    VirtualProtect((LPVOID)fakeFunctionAddr, size, oldProtection, &oldProtection);

    realFunction();

    while (true){
        cin.get();
    }
}

I want to understand why this happens, why not just the 6 bytes i replaced are changed ?

Answer 1

As you can see, the sub esp,0C0h instruction begins at address 00B533C3, but the next instruction push ebx begins at address 00B533C9. You have overwritten addresses 00B533C0 through 00B533C5, so immediately after your 6 bytes you are in the middle of the sub esp,0C0h instruction.

The disassembler has no way of knowing that a certain byte is garbage and not an instruction, so it tries to interpret the bytes as instructions, as best as it can, and what you see is, of course, nonsensical instructions. After a while it just so happens (by coincidence) that the end of a nonsensical instruction coincides with the end of an actual instruction that used to be there, so from that point on the disassembler interprets instructions successfully, that's why the remainder of your function looks okay.

If you look at the actual bytes, and not at the assembly language mnemonic interpretations of these bytes, you will see that nothing funky is going on.

(Except, perhaps, for the fact that you appear to have replaced 5, not 6 bytes.)