first version:

format PE GUI 4.0
entry start

include '%include%\win32a.inc'


section '.data' data readable writeable
wHandle     dd ?
Old_Protect dd ?
string     db 'normal execution',0
hstring    db 'I am modified!',0
captioN    db 'SMC example',0

data import

 library kernel32,'KERNEL32.DLL',\
         user32,'USER32.DLL',\
         winmm,'WINMM.DLL'

 import kernel32,\
        ExitProcess,'ExitProcess',\
        GetCurrentProcessId,'GetCurrentProcessId',\
        VirtualProtectEx,'VirtualProtectEx',\
        GetDesktopWindow,'GetDesktopWindow'

 import user32,\
        MessageBox,'MessageBoxA'

 import winmm,\
        mciSendString,'mciSendStringA'

end data


section '.code' code readable executable

start:

jmp Begin


hacked: ;the hook


                 invoke MessageBox,0,hstring,captioN,MB_OK
                 jmp exit



Begin:
                 invoke GetCurrentProcessId
                 invoke VirtualProtectEx,eax,hack_me,1,PAGE_EXECUTE_READWRITE,Old_Protect
                 jz  exit ;failed







                  call modify
                  xor eax,eax
hack_me:           ;gets replaced
                   invoke MessageBox,0,string,captioN,MB_OK


modify:

                 mov edi, to_write      ;load address of code-to-write in EDI
                 mov [hack_me], edi    ;write code to location 'hack_me:'
                 ret                   ;return from call
to_write:


                  jmp hacked

exit:
      invoke   ExitProcess,eax


second version:

format PE GUI 4.0
entry start

include '%include%\win32a.inc'


section '.data' data readable writeable
wHandle     dd ?
Old_Protect dd ?
string     db 'normal execution',0
hstring    db 'I am modified!',0
captioN    db 'SMC example',0

data import

 library kernel32,'KERNEL32.DLL',\
         user32,'USER32.DLL',\
         winmm,'WINMM.DLL'

 import kernel32,\
        ExitProcess,'ExitProcess',\
        GetCurrentProcessId,'GetCurrentProcessId',\
        VirtualProtectEx,'VirtualProtectEx',\
        GetDesktopWindow,'GetDesktopWindow'

 import user32,\
        MessageBox,'MessageBoxA'

 import winmm,\
        mciSendString,'mciSendStringA'

end data


section '.code' code readable executable

start:

jmp Begin


hacked: ;the hook


                 invoke MessageBox,wHandle,hstring,captioN,MB_OK
                 jmp exit



Begin:
                 invoke GetCurrentProcessId
                 invoke VirtualProtectEx,eax,hack_me,1,PAGE_EXECUTE_READWRITE,Old_Protect
                 jz  exit ;failed

                 invoke GetDesktopWindow
                 mov [wHandle],eax




                  call modify
                  xor eax,eax
hack_me:           ;gets replaced
                   invoke MessageBox,wHandle,string,captioN,MB_OK


modify:

                 mov edi, to_write      ;load address of code-to-write in EDI
                 mov [hack_me], edi    ;write code to location 'hack_me:'
                 ret                   ;return from call
to_write:


                  jmp hacked

exit:
      invoke   ExitProcess,eax


    

Begin: 
                 invoke GetCurrentProcessId 
                 invoke VirtualProtectEx,eax,hack_me,1,PAGE_EXECUTE_READWRITE,Old_Protect 
                 jz  exit ;failed 
    

GetCurrentProcess

The GetCurrentProcess function retrieves a pseudo handle for the current process.


HANDLE GetCurrentProcess(void);

Parameters
This function has no parameters.
Return Values
The return value is a pseudo handle to the current process.

Remarks
A pseudo handle is a special constant, currently (HANDLE)-1, that is interpreted as the current process handle. For compatibility with future operating systems, it is best to call GetCurrentProcess instead of hard-coding this constant value. The calling process can use a pseudo handle to specify its own process whenever a process handle is required. Pseudo handles are not inherited by child processes.

This handle has the maximum possible access to the process object. For systems that support security descriptors, this is the maximum access allowed by the security descriptor for the calling process. For systems that do not support security descriptors, this is PROCESS_ALL_ACCESS. For more information, see Process Security and Access Rights.

A process can create a "real" handle to itself that is valid in the context of other processes, or that can be inherited by other processes, by specifying the pseudo handle as the source handle in a call to the DuplicateHandle function. A process can also use the OpenProcess function to open a real handle to itself.

The pseudo handle need not be closed when it is no longer needed. Calling the CloseHandle function with a pseudo handle has no effect. If the pseudo handle is duplicated by DuplicateHandle, the duplicate handle must be closed.

 

mov edi, to_write      ;load address of code-to-write in EDI
mov [hack_me], edi    ;write code to location 'hack_me:'
ret                   ;return from call 
    

 
format PE GUI 4.0
entry start

include '%include%\win32ax.inc'


section '.data' data readable writeable
wHandle     dd ?
Old_Protect dd ?
string     db 'normal execution',0
hstring    db 'I am modified!',0
captioN    db 'SMC example',0

data import

library kernel32,'KERNEL32.DLL',\
         user32,'USER32.DLL',\
         winmm,'WINMM.DLL'

import kernel32,\
        ExitProcess,'ExitProcess',\
        GetCurrentProcessId,'GetCurrentProcessId',\
        GetCurrentProcess,'GetCurrentProcess',\
        VirtualProtectEx,'VirtualProtectEx',\
        GetDesktopWindow,'GetDesktopWindow'

import user32,\
        MessageBox,'MessageBoxA'

import winmm,\
        mciSendString,'mciSendStringA'

end data


section '.code' code readable executable

start:

jmp Begin

hacked: ;the hook

                 invoke MessageBox,0,hstring,captioN,MB_OK
                 jmp exit
Begin:
                 invoke GetCurrentProcess; Id
                 invoke VirtualProtectEx,eax,hack_me,4,PAGE_EXECUTE_READWRITE,Old_Protect
                 or  eax, eax
                 jz  exit ;failed

                 call modify
                 xor eax,eax
hack_me:           ;gets replaced
                 invoke MessageBox,0,string,captioN,MB_OK
modify:
                 ; 0EBh is the first
                 ; byte for the jmp instruction
                 ; The next byte for the
                 ; instruction is the number of
                 ; bytes to jmp.This is calculated by
                 ; subtracting the address of the code
                 ; that begins the call to the message box
                 ; function by the address of the code
                 ; that jumps to that address.2 has to be added
                 ; since the jmp is a two bye instruction

                 mov esi, hack_me
                 mov byte [esi], 0EBh    ;write code to location 'hack_me:'
                 mov al, hacked - hack_me - 2
                 mov byte [esi + 1], al

                 ret                   ;return from call
to_write:
                 jmp hacked

exit:
                invoke   ExitProcess,eax