#include #include #define FUNCADDR 0x40000000 __declspec(dllexport) int test(void) { // MOV EAX,FEEDBEEF // RETN unsigned char c[] = "\xB8\xEF\xBE\xED\xFE\xC3"; void *f = VirtualAlloc((void *) FUNCADDR, sizeof(c), MEM_RESERVE, PAGE_EXECUTE_READWRITE); if (f != (void *) FUNCADDR) { printf("can't alloc memory!\n"); return 1; } VirtualAlloc((void *) FUNCADDR, sizeof(c), MEM_COMMIT, PAGE_EXECUTE_READWRITE); memcpy(f, c, sizeof(c)); FlushInstructionCache(GetCurrentProcess(), f, sizeof(c)); unsigned (*fn)(void) = (void *) FUNCADDR; printf("by pointer variable: %08X\n", fn()); printf("by pointer constant: %08X\n", ((unsigned (*)(void)) FUNCADDR)()); return 0; }