如何复制一个API函数，然后调用他？(200分)

现在需要复制一个API函数到内存，然后调用他，绕过原来的API函数？<br>有没有这样的例子？<br>比如说将MessageBox这个API函数在内存中复制出来，新的API入口，然后怎样调用这个复制出来的API? 跟API HOOK有点类似，就是不知道怎么做？

看来我帮不上你的忙，只能帮你顶一下

type<br> &nbsp;TCode5=packed record<br> &nbsp; &nbsp;siJmp:Byte;<br> &nbsp; &nbsp;dwAddrWORD;<br> &nbsp;end;<br><br> &nbsp;TThunkCode=packed record<br> &nbsp; &nbsp;codeBak:TCode5;<br> &nbsp; &nbsp;codeThunk:TCode5;<br> &nbsp; &nbsp;addr_Sysointer;<br> &nbsp; &nbsp;addr_Thunkointer;<br> &nbsp;end;<br><br>type<br> &nbsp;TMessageBoxA=function(hWnd: HWND; lpText, lpCaption: PAnsiChar; uType: UINT): Integer; stdcall;<br><br>var<br> &nbsp;ThunkCode:TThunkCode;<br> &nbsp;hProcess:THandle;<br><br>function MyMessageBoxA(hWnd: HWND; lpText, lpCaption: PAnsiChar; uType: UINT): Integer; stdcall;<br>var<br> &nbsp;dwByetsWriteWORD;<br>begin<br> &nbsp;ShowMessage('testing...');<br> &nbsp;WriteProcessMemory(hProcess,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ThunkCode.addr_Sys,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; @ThunkCode.codeBak,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 5,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dwByetsWrite);<br> &nbsp;TMessageBoxA(ThunkCode.addr_Sys)(hwnd,lpText,lpCaption,uType);<br> &nbsp;WriteProcessMemory(hProcess,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ThunkCode.addr_Sys,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; @ThunkCode.codeThunk,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 5,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dwByetsWrite);<br>end;<br><br>procedure TForm1.Button1Click(Sender: TObject);<br>const<br> &nbsp;szDllName='user32.dll';<br> &nbsp;szProcName='MessageBoxA';<br>var<br> &nbsp;hMod:HMODULE;<br> &nbsp;P:TMessageBoxA;<br> &nbsp;dwBytesReadWORD;<br>begin<br> &nbsp;hMod:=GetModuleHandle(szDllName);<br> &nbsp;ThunkCode.addr_Sys:=Pointer(GetProcAddress(hMod,szProcName));<br> &nbsp;ThunkCode.addr_Thunk:=@MyMessageBoxA;<br> &nbsp;ThunkCode.codeThunk.siJmp:=Byte($E9);<br> &nbsp;ThunkCode.codeThunk.dwAddr:=DWORD(ThunkCode.addr_Thunk)-DWORD(ThunkCode.addr_Sys)-5;<br> &nbsp;ThunkCode.codeBak.siJmp:=PByte(ThunkCode.addr_Sys)^;<br> &nbsp;ThunkCode.codeBak.dwAddr:=PDWORD(DWORD(ThunkCode.addr_Sys)+1)^;<br> &nbsp;hProcess:=GetCurrentProcess;<br> &nbsp;WriteProcessMemory(hProcess,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ThunkCode.addr_Sys,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; @ThunkCode.codeThunk,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 5,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dwBytesRead);<br>end;<br><br>procedure TForm1.Button2Click(Sender: TObject);<br>begin<br> &nbsp;MyMessageBoxA(0,nil,nil,0);<br>end;

to smokingroom: 这个方法不行，不能改变原来api内容。<br>我的意思是把api完整的复制一份到内存，然后在调用。

学习……

原理上可以实现，不过涉及到汇编的重定位的问题，很麻烦！特别是你要随机将一个API复制出来，而又要它能正常运行的话。

不是随机，是指定的API