Make unhook after hookado

Question

To make a hook I know, I do it as follows (Fictitious variables):

MSGBOX:=GetProcAddress(GetModuleHandle('kernel32.dll'),'MessageBox');
  ReadProcessMemory(INVALID_HANDLE_VALUE,MSGBOX,@OldMSG,sizeof(oldcode),b);

  Jmpmsg.push:=$68;
  Jmpmsg.PProc:=@NewMSG;
  Jmpmsg.ret:=$C3;

  WriteProcessMemory(INVALID_HANDLE_VALUE,CPA,@Jmpmsg,sizeof(far_jmp),b);

How can I be doing the Unhook?

I’ve tried it this way:

WriteProcessMemory(INVALID_HANDLE_VALUE,MSGBOX,@OldMSG,sizeof(Oldcode),b);

But make a mistake :(

Answer 1

Try to make a memory backup before replacing the original call:

//faz o backup
ReadProcessMemory(INVALID_HANDLE_VALUE, CPA, @backup, sizeof(far_jmp), bytesBackup);

//substitui a chamada(faz o hook)
WriteProcessMemory(INVALID_HANDLE_VALUE, CPA, @Jmpmsg, sizeof(far_jmp), b);

//restaura o backup
WriteProcessMemory(INVALID_HANDLE_VALUE, CPA, @backup, bytesBackup, b);