Code:
asm_eax = 0, asm_ecx = 0, asm_edx = 0, asm_ebx = 0, asm_esp = 0, asm_ebp = 0, asm_esi = 0, asm_edi = 0;
You don't need to store registers in memory locations, you can simply use the stack, and use the pushad/popad instructions.
Code:
char DBCommand[128] = "UPDATE Account SET UGradeID=253 WHERE AID=%d",
*DBCommandUse = "UPDATE Account SET UGradeID=253 WHERE AID=0";
Then later..
Code:
sprintf_s(DBCommand, "UPDATE Account SET UGradeID=253 WHERE AID=%d", AID);
That's redundant; also, a static buffer size isn't good, even if you're using the safe sprintf function to check it in this case. You could simply allow an AID of a large size, so it's something more along the lines of:
CHAR DBCommand[] = "UPDATE Account SET UGradeID=253 WHERE AID=1234567890";
That will support an AID up to 10 bytes; from there, just check if the AID string exceeds 10 characters before using the string, in the future.
You don't need to detour in memory, also, like you're doing here:
Code:
memset(Buffer,0x90,10);
Buffer[0] = 0xE9;
Buffer[1] = bHook[0];
Buffer[2] = bHook[1];
Buffer[3] = bHook[2];
Buffer[4] = bHook[3];
Rather, write a tool to automatically detour matchserver on disk, attempting to match a byte signature for where your hook needs to be.
Then, simply add the DLL to the IAT, and have the detour be on an exported function of the DLL.
Or, an even better method for something this small - use a codecave to embed everything in. You can add a new segment with space for strings and other data for future modifications; this would just be one of many.
But, that's just my opinion.
Code:
Hook = Hook - Function - 5;
This can be made more readable, and make more sense to reading devs by using, say, a separate function:
Code:
uintptr_t FORCEINLINE JMP(uintptr_t hook, uintptr_t function)
{
return (hook - function - sizeof(uintptr_t) - 1);
}