Use a library like Microsoft Detours or EasyHook, both of which support exactly this kind of patching, and one of which at least works in x64.
Swingline Rage
2010-06-09 23:43:47
A:
Detours is not free for comercial usage, and I really would like to do it instead of just linking to some 3rd party library.EasyHook is managed, and my project is native. No go.
Jorge Vasquez
2010-06-10 04:25:02
+2
A:
In x64 the return value is in RAX, which is the 64bit version of EAX. But because the upper 32 bits are cleared when a 32 bit sub-register is written, "xor eax, eax" is equivalent to "xor rax, rax" and doesn't need to be changed.
However, because the calling convention is different on x64, the same return instruction won't work there: In x86 winapi functions use the stdcall convention, where the callee pops the arguments from the stack (hence the "retn 4" instruction, which pops that one argument from SetUnhandledExceptionFilter off the stack (you may want to fix that comment in your code)). In x64 the stack is not cleaned by the callee, so a normal "retn" instruction needs to be used:
const BYTE PatchBytes[3] = { 0x33, 0xC0, 0xC3 }; // XOR EAX,EAX; RET;