title: Calculating offset for hotpatching/inline function hooking
body: <p>From <a href="http://lastfrag.com/hotpatching-and-inline-hooking-explained/" rel="nofollow">http://lastfrag.com/hotpatching-and-inline-hooking-explained/</a>,</p>
  
  <p>Q1) Does code proceed from high memory to low memory or vice versa?</p>
  
  <p>Q2) More importantly, during the calculation of the replacement offset, why is it that you have to minus the function preamble? Is it because the offset starts from the end of the instruction and not the beginning?</p>
  
  <pre><code>DWORD ReplacementAddressOffset = ReplacementAddress - OriginalAddress - 5;
  </code></pre>
  
  <p>Full Code:</p>
  
  <pre><code>void HookAPI(wchar_t *Module, char *API, DWORD Function)
  {
      HMODULE hModule = LoadLibrary(Module);
      DWORD OriginalAddress = (DWORD)GetProcAddress(hModule, API);
      DWORD ReplacementAddress = (DWORD)Function;
      DWORD ReplacementAddressOffset = ReplacementAddress - OriginalAddress - 5;
      LPBYTE pOriginalAddress = (LPBYTE)OriginalAddress;
      LPBYTE pReplacementAddressOffset = (LPBYTE)(&amp;ReplacementAddressOffset);
  
      DWORD OldProtect = 0;
      DWORD NewProtect = PAGE_EXECUTE_READWRITE;
  
      VirtualProtect((PVOID)OriginalAddress, 5, NewProtect, &amp;OldProtect);
  
      for (int i = 0; i &lt; 5; i++)
          Store[i] = pOriginalAddress[i];
  
      pOriginalAddress[0] = (BYTE)0xE9;
  
      for (int i = 0; i &lt; 4; i++)
          pOriginalAddress[i + 1] = pReplacementAddressOffset[i];
  
      VirtualProtect((PVOID)OriginalAddress, 5, OldProtect, &amp;NewProtect);
  
      FlushInstructionCache(GetCurrentProcess(), NULL, NULL);
  
      FreeLibrary(hModule);
  }
  </code></pre>
  
  <p>Q3) In this code, the relative address of a jmp instruction is being replaced; relAddrSet is a pointer to the original destination; to is a pointer to the new destination. I don't understand the calculation of the to address, why is it that you have to add the original destination to the functionForHook + opcodeOffset?</p>
  
  <pre><code>DWORD *relAddrSet = (DWORD *)(currentOpcode + 1);
  DWORD_PTR to = (*relAddrSet) + ((DWORD_PTR)functionForHook + opcodeOffset);
  *relAddrSet = (DWORD)(to - ((DWORD_PTR)originalFunction + opcodeOffset));
  </code></pre>