关于API的HOOK(100分)

  • 主题发起人 主题发起人 sbzldlb
  • 开始时间 开始时间
S

sbzldlb

Unregistered / Unconfirmed
GUEST, unregistred user!
为什么我把函数的入口地址改了,还是执行原来的函数呢?请高手赐教,谢谢!!!
procedure TForm1.Button1Click(Sender: TObject);
var
DllHandle:LongWord;
dwSize: cardinal;
begin
DllHandle:=LoadLibrary('Hook.dll');
if DllHandle>0 then
begin
@InstallHook:=GetProcAddress(DllHandle,'InstallHook');
@UnHook:=GetProcAddress(DllHandle,'UnHook');
@InstallHook1:=GetProcAddress(DllHandle,'InstallHook1');
if (@InstallHook=Nil) or (@UnHook=nil) or (@InstallHook1=Nil) then
begin
showmessage('No Add');
Exit;
end else
begin
ReadProcessMemory(OpenProcess(PROCESS_ALL_ACCESS, True, GetCurrentProcessId),
@InstallHook,
@JmpCode,
5,
dwSize);
JmpCode.Address := DWord(@InstallHook1);//新函数的地址

//WriteProcessMemory(OpenProcess(PROCESS_ALL_ACCESS, True, GetCurrentProcessId),
// @InstallHook,
// {@InstallHook1}@JmpCode,
// {Integer(@InstallHook1)-Integer(@InstallHook)}5,
// dwSize);

//WriteProcessMemory(OpenProcess(PROCESS_ALL_ACCESS, True, GetCurrentProcessId),
// @InstallHook,
// @InstallHook1,
// Integer(@InstallHook1)-Integer(@InstallHook),
// dwSize);

VirtualProtectEx(OpenProcess(PROCESS_ALL_ACCESS, True, GetCurrentProcessId)
,@InstallHook
,5
,PAGE_READWRITE
,@GetCurrentProcessId);//修改属性

if WriteProcessMemory(OpenProcess(PROCESS_ALL_ACCESS, True, GetCurrentProcessId),
@InstallHook,
@JmpCode,
5,
dwSize)then showmessage('OK');

sleep(100);
InstallHook;
end;
end else
begin
showmessage('no Dll');
Exit;
end;
end;
 
WriteProcessMemory读和写应该是8个字节吧?!
给出的代码不齐全,你是怎么定义JmpCode的结构的.
 
TJmpCode = packed record
JmpCode: BYTE;
Address: DWord;
end;
 
我自己解决了
 
怎么解决的
 
多人接受答案了。
 
后退
顶部