如何恢復被Hook的Api ( 积分: 100 )

我在論壇搜索到Hook&nbsp;Api的代碼如下,編譯後程序是可以Hook到CreateProcess函數,但在程序退出時調用UnHook,發現並無法恢復原來的Api,在開啟程序時會提示:<br>'&quot;0x02cacb54&quot;指令參考的&quot;0x02cacb54&quot;記憶體.該記憶體不能為&quot;read&quot;&nbsp;<br>按[確定]終止程序<br>按[取消]進行程序偵錯<br>請問如何解決?謝謝.<br>http://www.delphibbs.com/delphibbs/dispq.asp?lid=3319981<br>{-------------------Hook.dpr----------------------}<br>{&nbsp;这个是DLL&nbsp;}<br>library&nbsp;Hook;<br><br>uses<br>&nbsp;&nbsp;SysUtils,<br>&nbsp;&nbsp;windows,<br>&nbsp;&nbsp;Messages,<br>&nbsp;&nbsp;APIHook&nbsp;in&nbsp;'APIHook.pas';<br><br>var<br>&nbsp;&nbsp;DllHook:&nbsp;HHOOK;<br><br>procedure&nbsp;HookProc(nCode,&nbsp;wParam,&nbsp;lParam:&nbsp;LongWORD);stdcall;<br>begin<br>&nbsp;&nbsp;CallNextHookEx(DllHook,&nbsp;nCode,&nbsp;wParam,&nbsp;lParam);<br>end;<br><br>{&nbsp;状态挂钩&nbsp;}<br>function&nbsp;InstallHook:&nbsp;Boolean;&nbsp;stdcall;<br>begin<br>&nbsp;&nbsp;DllHook&nbsp;:=&nbsp;SetWindowsHookEx(WH_GETMESSAGE,&nbsp;@HookProc,&nbsp;Hinstance,&nbsp;0);<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;DllHook&nbsp;&gt;&nbsp;0;<br>end;<br><br>{&nbsp;卸载挂钩&nbsp;}<br>procedure&nbsp;UnHook;&nbsp;stdcall;<br>begin<br>&nbsp;&nbsp;UnHookAPI;<br>&nbsp;&nbsp;UnhookWindowsHookEx(DllHook);<br>end;<br><br>procedure&nbsp;MyDLLHandler(Reason:&nbsp;Integer);<br>begin&nbsp;<br>&nbsp;&nbsp;case&nbsp;Reason&nbsp;of<br>&nbsp;&nbsp;&nbsp;&nbsp;DLL_PROCESS_ATTACH:&nbsp;HookAPI;<br>&nbsp;&nbsp;&nbsp;&nbsp;DLL_PROCESS_DETACH:&nbsp;UnHook;<br>&nbsp;&nbsp;end;&nbsp;<br>end;&nbsp;<br><br>exports&nbsp;<br>&nbsp;&nbsp;InstallHook,UnHook;<br><br>begin&nbsp;<br>&nbsp;&nbsp;DLLProc&nbsp;:=&nbsp;@MyDLLHandler;<br>&nbsp;&nbsp;MyDLLhandler(DLL_PROCESS_ATTACH);<br>end.<br><br>{------------------APIHook.pas---------------------}<br><br>unit&nbsp;APIHook;<br><br>interface&nbsp;<br><br>uses&nbsp;<br>&nbsp;SysUtils,&nbsp;Windows,&nbsp;WinSock,&nbsp;Dialogs;<br><br>type&nbsp;<br>&nbsp;{&nbsp;要HOOK的API函数定义&nbsp;}<br>&nbsp;TCreatePA&nbsp;=&nbsp;function&nbsp;(lpApplicationName:&nbsp;PAnsiChar;&nbsp;lpCommandLine:&nbsp;PAnsiChar;<br>&nbsp;&nbsp;&nbsp;lpProcessAttributes,&nbsp;lpThreadAttributes:&nbsp;PSecurityAttributes;<br>&nbsp;&nbsp;&nbsp;bInheritHandles:&nbsp;BOOL;&nbsp;dwCreationFlags:&nbsp;DWORD;&nbsp;lpEnvironment:&nbsp;Pointer;<br>&nbsp;&nbsp;&nbsp;lpCurrentDirectory:&nbsp;PAnsiChar;&nbsp;const&nbsp;lpStartupInfo:&nbsp;TStartupInfo;<br>&nbsp;&nbsp;&nbsp;var&nbsp;lpProcessInformation:&nbsp;TProcessInformation):&nbsp;BOOL;&nbsp;stdcall;<br><br>&nbsp;&nbsp;TCreatePW&nbsp;=&nbsp;function&nbsp;(lpApplicationName:&nbsp;PWideChar;&nbsp;lpCommandLine:&nbsp;PWideChar;<br>&nbsp;&nbsp;&nbsp;&nbsp;lpProcessAttributes,&nbsp;lpThreadAttributes:&nbsp;PSecurityAttributes;<br>&nbsp;&nbsp;&nbsp;&nbsp;bInheritHandles:&nbsp;BOOL;&nbsp;dwCreationFlags:&nbsp;DWORD;&nbsp;lpEnvironment:&nbsp;Pointer;<br>&nbsp;&nbsp;&nbsp;&nbsp;lpCurrentDirectory:&nbsp;PWideChar;&nbsp;const&nbsp;lpStartupInfo:&nbsp;TStartupInfo;<br>&nbsp;&nbsp;&nbsp;&nbsp;var&nbsp;lpProcessInformation:&nbsp;TProcessInformation):&nbsp;BOOL;&nbsp;stdcall;<br><br>&nbsp;&nbsp;&nbsp;&nbsp;<br>&nbsp;procedure&nbsp;HookAPI;&nbsp;<br>&nbsp;procedure&nbsp;UnHookAPI;<br><br>var<br>&nbsp;&nbsp;ProcessHandle:&nbsp;HWND;<br>&nbsp;&nbsp;BaseAddress:&nbsp;array&nbsp;[0..2]&nbsp;of&nbsp;Pointer;<br>&nbsp;&nbsp;OldProc:&nbsp;array&nbsp;[0..2]&nbsp;of&nbsp;array&nbsp;[0..7]&nbsp;of&nbsp;Byte;<br>&nbsp;&nbsp;NewPorc:&nbsp;array&nbsp;[0..2]&nbsp;of&nbsp;array&nbsp;[0..7]&nbsp;of&nbsp;Byte;<br><br>implementation<br><br>{&nbsp;自定义的函数,用于覆盖系统的CreateProcessA函数&nbsp;}<br>function&nbsp;MyCreatePA(lpApplicationName:&nbsp;PAnsiChar;&nbsp;lpCommandLine:&nbsp;PAnsiChar;<br>&nbsp;&nbsp;lpProcessAttributes,&nbsp;lpThreadAttributes:&nbsp;PSecurityAttributes;<br>&nbsp;&nbsp;bInheritHandles:&nbsp;BOOL;&nbsp;dwCreationFlags:&nbsp;DWORD;&nbsp;lpEnvironment:&nbsp;Pointer;<br>&nbsp;&nbsp;lpCurrentDirectory:&nbsp;PAnsiChar;&nbsp;const&nbsp;lpStartupInfo:&nbsp;TStartupInfo;<br>&nbsp;&nbsp;var&nbsp;lpProcessInformation:&nbsp;TProcessInformation):&nbsp;BOOL;&nbsp;stdcall;<br>var<br>&nbsp;&nbsp;nSize:&nbsp;Cardinal;<br>begin<br>&nbsp;&nbsp;{&nbsp;显示打开程序的文件名(这个有问题,文件名为空)和所在文件夹&nbsp;}<br>&nbsp;&nbsp;MessageBoxA(0,&nbsp;lpApplicationName,&nbsp;lpCurrentDirectory,&nbsp;0);<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@OldProc[0],&nbsp;8,&nbsp;nSize);<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;CreateProcessA(lpApplicationName,&nbsp;lpCommandLine,&nbsp;lpProcessAttributes,<br>&nbsp;&nbsp;&nbsp;lpThreadAttributes,&nbsp;bInheritHandles,&nbsp;dwCreationFlags,&nbsp;lpEnvironment,<br>&nbsp;&nbsp;&nbsp;lpCurrentDirectory,&nbsp;lpStartupInfo,&nbsp;lpProcessInformation);<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@NewPorc[0],&nbsp;8,&nbsp;nSize);<br>end;<br><br>{&nbsp;同上&nbsp;}<br>function&nbsp;MyCreatePW(lpApplicationName:&nbsp;PWideChar;&nbsp;lpCommandLine:&nbsp;PWideChar;<br>&nbsp;&nbsp;&nbsp;&nbsp;lpProcessAttributes,&nbsp;lpThreadAttributes:&nbsp;PSecurityAttributes;<br>&nbsp;&nbsp;&nbsp;&nbsp;bInheritHandles:&nbsp;BOOL;&nbsp;dwCreationFlags:&nbsp;DWORD;&nbsp;lpEnvironment:&nbsp;Pointer;<br>&nbsp;&nbsp;&nbsp;&nbsp;lpCurrentDirectory:&nbsp;PWideChar;&nbsp;const&nbsp;lpStartupInfo:&nbsp;TStartupInfo;<br>&nbsp;&nbsp;&nbsp;&nbsp;var&nbsp;lpProcessInformation:&nbsp;TProcessInformation):&nbsp;BOOL;&nbsp;stdcall;<br>var<br>&nbsp;&nbsp;nSize:&nbsp;Cardinal;<br>begin<br>&nbsp;&nbsp;{&nbsp;显示打开程序的命令行和文件名(这个有问题,文件名为空,其他都有值)&nbsp;}<br>&nbsp;&nbsp;MessageBoxW(0,&nbsp;lpCommandLine&nbsp;,lpApplicationName&nbsp;,&nbsp;0);<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[1],&nbsp;@OldProc[1],&nbsp;8,&nbsp;nSize);<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;CreateProcessW(lpApplicationName,&nbsp;lpCommandLine,&nbsp;lpProcessAttributes,<br>&nbsp;&nbsp;&nbsp;lpThreadAttributes,&nbsp;bInheritHandles,&nbsp;dwCreationFlags,&nbsp;lpEnvironment,<br>&nbsp;&nbsp;&nbsp;lpCurrentDirectory,&nbsp;lpStartupInfo,&nbsp;lpProcessInformation);<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[1],&nbsp;@NewPorc[1],&nbsp;8,&nbsp;nSize);<br>end;<br><br>procedure&nbsp;HookAPI;<br>var<br>&nbsp;&nbsp;DLLModule:&nbsp;THandle;<br>&nbsp;&nbsp;nSize:&nbsp;Cardinal;<br>&nbsp;&nbsp;Dat:&nbsp;DWORD;<br>&nbsp;&nbsp;Tmp&nbsp;:&nbsp;array&nbsp;[0..3]&nbsp;of&nbsp;Byte;<br>begin<br>&nbsp;&nbsp;ProcessHandle&nbsp;:=&nbsp;DWORD(-1);<br>&nbsp;&nbsp;DLLModule&nbsp;:=&nbsp;LoadLibrary('kernel32.dll');<br>&nbsp;&nbsp;{&nbsp;系统函数入口点地址&nbsp;}<br>&nbsp;&nbsp;BaseAddress[0]&nbsp;:=&nbsp;GetProcAddress(DLLModule,&nbsp;'CreateProcessA');<br>&nbsp;&nbsp;Dat&nbsp;:=&nbsp;DWORD(@MyCreatePA);<br>&nbsp;&nbsp;Move(Dat,&nbsp;Tmp,&nbsp;4);<br>&nbsp;&nbsp;NewPorc[0][0]&nbsp;:=&nbsp;$B8;&nbsp;{&nbsp;汇编跳转指令&nbsp;}<br>&nbsp;&nbsp;NewPorc[0][1]&nbsp;:=&nbsp;Tmp[0];&nbsp;{&nbsp;跳转到自身的函数&nbsp;}<br>&nbsp;&nbsp;NewPorc[0][2]&nbsp;:=&nbsp;Tmp[1];<br>&nbsp;&nbsp;NewPorc[0][3]&nbsp;:=&nbsp;Tmp[2];<br>&nbsp;&nbsp;NewPorc[0][4]&nbsp;:=&nbsp;Tmp[3];<br>&nbsp;&nbsp;NewPorc[0][5]&nbsp;:=&nbsp;$FF;<br>&nbsp;&nbsp;NewPorc[0][6]&nbsp;:=&nbsp;$E0;<br>&nbsp;&nbsp;NewPorc[0][7]&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;{&nbsp;读取系统函数内存地址&nbsp;}<br>&nbsp;&nbsp;ReadProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@OldProc[0],&nbsp;8,&nbsp;nSize);<br>&nbsp;&nbsp;{&nbsp;用自己的函数地址覆盖系统的函数地址&nbsp;}<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@NewPorc[0],&nbsp;8,&nbsp;nSize);<br><br>&nbsp;&nbsp;{&nbsp;同上&nbsp;}<br>&nbsp;&nbsp;BaseAddress[1]&nbsp;:=&nbsp;GetProcAddress(DLLModule,&nbsp;'CreateProcessW');<br>&nbsp;&nbsp;Dat&nbsp;:=&nbsp;DWORD(@MyCreatePW);<br>&nbsp;&nbsp;Move(Dat,&nbsp;Tmp,&nbsp;4);<br>&nbsp;&nbsp;NewPorc[1][0]&nbsp;:=&nbsp;$B8;<br>&nbsp;&nbsp;NewPorc[1][1]&nbsp;:=&nbsp;Tmp[0];<br>&nbsp;&nbsp;NewPorc[1][2]&nbsp;:=&nbsp;Tmp[1];<br>&nbsp;&nbsp;NewPorc[1][3]&nbsp;:=&nbsp;Tmp[2];<br>&nbsp;&nbsp;NewPorc[1][4]&nbsp;:=&nbsp;Tmp[3];<br>&nbsp;&nbsp;NewPorc[1][5]&nbsp;:=&nbsp;$FF;<br>&nbsp;&nbsp;NewPorc[1][6]&nbsp;:=&nbsp;$E0;<br>&nbsp;&nbsp;NewPorc[1][7]&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;ReadProcessMemory(ProcessHandle,&nbsp;BaseAddress[1],&nbsp;@OldProc[1],&nbsp;8,&nbsp;nSize);<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[1],&nbsp;@NewPorc[1],&nbsp;8,&nbsp;nSize);<br>end;<br><br>procedure&nbsp;UnHookAPI;<br>var<br>&nbsp;&nbsp;nSize:&nbsp;Cardinal;<br>begin<br>&nbsp;&nbsp;{&nbsp;恢复所修改的地址&nbsp;}<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@OldProc[0],&nbsp;8,&nbsp;nSize);<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[1],&nbsp;@OldProc[1],&nbsp;8,&nbsp;nSize);<br>end;<br><br>end.

代码太乱七八糟了。

呵呵...我簡略一下,只剩Hook&nbsp;CreateProcessW,請指教.<br>{------------------APIHook.pas---------------------}<br><br>unit&nbsp;APIHook;<br><br>interface&nbsp;<br><br>uses&nbsp;<br>&nbsp;SysUtils,&nbsp;Windows,&nbsp;WinSock,&nbsp;Dialogs;<br><br>type&nbsp;<br>&nbsp;{&nbsp;要HOOK的API函数定义&nbsp;}<br>&nbsp;&nbsp;TCreatePW&nbsp;=&nbsp;function&nbsp;(lpApplicationName:&nbsp;PWideChar;&nbsp;lpCommandLine:&nbsp;PWideChar;<br>&nbsp;&nbsp;&nbsp;&nbsp;lpProcessAttributes,&nbsp;lpThreadAttributes:&nbsp;PSecurityAttributes;<br>&nbsp;&nbsp;&nbsp;&nbsp;bInheritHandles:&nbsp;BOOL;&nbsp;dwCreationFlags:&nbsp;DWORD;&nbsp;lpEnvironment:&nbsp;Pointer;<br>&nbsp;&nbsp;&nbsp;&nbsp;lpCurrentDirectory:&nbsp;PWideChar;&nbsp;const&nbsp;lpStartupInfo:&nbsp;TStartupInfo;<br>&nbsp;&nbsp;&nbsp;&nbsp;var&nbsp;lpProcessInformation:&nbsp;TProcessInformation):&nbsp;BOOL;&nbsp;stdcall;<br><br>&nbsp;&nbsp;&nbsp;&nbsp;<br>&nbsp;procedure&nbsp;HookAPI;&nbsp;<br>&nbsp;procedure&nbsp;UnHookAPI;<br><br>var<br>&nbsp;&nbsp;ProcessHandle:&nbsp;HWND;<br>&nbsp;&nbsp;BaseAddress:&nbsp;array&nbsp;[0..2]&nbsp;of&nbsp;Pointer;<br>&nbsp;&nbsp;OldProc:&nbsp;array&nbsp;[0..2]&nbsp;of&nbsp;array&nbsp;[0..7]&nbsp;of&nbsp;Byte;<br>&nbsp;&nbsp;NewPorc:&nbsp;array&nbsp;[0..2]&nbsp;of&nbsp;array&nbsp;[0..7]&nbsp;of&nbsp;Byte;<br><br>implementation<br><br>{&nbsp;自定义的函数,用于覆盖系统的CreateProcessW函数&nbsp;}<br>function&nbsp;MyCreatePW(lpApplicationName:&nbsp;PWideChar;&nbsp;lpCommandLine:&nbsp;PWideChar;<br>&nbsp;&nbsp;&nbsp;&nbsp;lpProcessAttributes,&nbsp;lpThreadAttributes:&nbsp;PSecurityAttributes;<br>&nbsp;&nbsp;&nbsp;&nbsp;bInheritHandles:&nbsp;BOOL;&nbsp;dwCreationFlags:&nbsp;DWORD;&nbsp;lpEnvironment:&nbsp;Pointer;<br>&nbsp;&nbsp;&nbsp;&nbsp;lpCurrentDirectory:&nbsp;PWideChar;&nbsp;const&nbsp;lpStartupInfo:&nbsp;TStartupInfo;<br>&nbsp;&nbsp;&nbsp;&nbsp;var&nbsp;lpProcessInformation:&nbsp;TProcessInformation):&nbsp;BOOL;&nbsp;stdcall;<br>var<br>&nbsp;&nbsp;nSize:&nbsp;Cardinal;<br>begin<br>&nbsp;&nbsp;{&nbsp;显示打开程序的命令行和文件名}<br>&nbsp;&nbsp;MessageBoxW(0,&nbsp;lpCommandLine&nbsp;,lpApplicationName&nbsp;,&nbsp;0);<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@OldProc[0],&nbsp;8,&nbsp;nSize);<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;CreateProcessW(lpApplicationName,&nbsp;lpCommandLine,&nbsp;lpProcessAttributes,<br>&nbsp;&nbsp;&nbsp;lpThreadAttributes,&nbsp;bInheritHandles,&nbsp;dwCreationFlags,&nbsp;lpEnvironment,<br>&nbsp;&nbsp;&nbsp;lpCurrentDirectory,&nbsp;lpStartupInfo,&nbsp;lpProcessInformation);<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@NewPorc[0],&nbsp;8,&nbsp;nSize);<br>end;<br><br>procedure&nbsp;HookAPI;<br>var<br>&nbsp;&nbsp;DLLModule:&nbsp;THandle;<br>&nbsp;&nbsp;nSize:&nbsp;Cardinal;<br>&nbsp;&nbsp;Dat:&nbsp;DWORD;<br>&nbsp;&nbsp;Tmp&nbsp;:&nbsp;array&nbsp;[0..3]&nbsp;of&nbsp;Byte;<br>begin<br>&nbsp;&nbsp;ProcessHandle&nbsp;:=&nbsp;DWORD(-1);<br>&nbsp;&nbsp;DLLModule&nbsp;:=&nbsp;LoadLibrary('kernel32.dll');<br>&nbsp;&nbsp;{&nbsp;系统函数入口点地址&nbsp;}<br>&nbsp;&nbsp;BaseAddress[0]&nbsp;:=&nbsp;GetProcAddress(DLLModule,&nbsp;'CreateProcessW');<br>&nbsp;&nbsp;Dat&nbsp;:=&nbsp;DWORD(@MyCreatePA);<br>&nbsp;&nbsp;Move(Dat,&nbsp;Tmp,&nbsp;4);<br>&nbsp;&nbsp;NewPorc[0][0]&nbsp;:=&nbsp;$B8;&nbsp;{&nbsp;汇编跳转指令&nbsp;}<br>&nbsp;&nbsp;NewPorc[0][1]&nbsp;:=&nbsp;Tmp[0];&nbsp;{&nbsp;跳转到自身的函数&nbsp;}<br>&nbsp;&nbsp;NewPorc[0][2]&nbsp;:=&nbsp;Tmp[1];<br>&nbsp;&nbsp;NewPorc[0][3]&nbsp;:=&nbsp;Tmp[2];<br>&nbsp;&nbsp;NewPorc[0][4]&nbsp;:=&nbsp;Tmp[3];<br>&nbsp;&nbsp;NewPorc[0][5]&nbsp;:=&nbsp;$FF;<br>&nbsp;&nbsp;NewPorc[0][6]&nbsp;:=&nbsp;$E0;<br>&nbsp;&nbsp;NewPorc[0][7]&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;{&nbsp;读取系统函数内存地址&nbsp;}<br>&nbsp;&nbsp;ReadProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@OldProc[0],&nbsp;8,&nbsp;nSize);<br>&nbsp;&nbsp;{&nbsp;用自己的函数地址覆盖系统的函数地址&nbsp;}<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@NewPorc[0],&nbsp;8,&nbsp;nSize);<br>end;<br><br>procedure&nbsp;UnHookAPI;<br>var<br>&nbsp;&nbsp;nSize:&nbsp;Cardinal;<br>begin<br>&nbsp;&nbsp;{&nbsp;恢复所修改的地址&nbsp;}<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@OldProc[0],&nbsp;8,&nbsp;nSize);<br>end;<br><br>end.

@OldProc[0]&nbsp;的内容是哪里来的？

只有聲明,沒有執行代碼.<br>OldProc:&nbsp;array&nbsp;[0..2]&nbsp;of&nbsp;array&nbsp;[0..7]&nbsp;of&nbsp;Byte;<br>請問如何修改?

http://www.51zhan.com&nbsp;最好的网址站&nbsp;<br>http://www.51zhan.com&nbsp;最好的网址站&nbsp;<br>http://www.51zhan.com&nbsp;最好的网址站

以前有一篇文章讲如何截取网络游戏封包，但给出的代码只是Hook了两个API函数，而且好用。这段代码与你的代码最大的不同是这部分：<br>&nbsp;&nbsp;Move(Dat,&nbsp;Tmp,&nbsp;4);<br>&nbsp;&nbsp;NewPorc[0][0]&nbsp;:=&nbsp;$B8;&nbsp;{&nbsp;汇编跳转指令&nbsp;}<br>&nbsp;&nbsp;NewPorc[0][1]&nbsp;:=&nbsp;Tmp[0];&nbsp;{&nbsp;跳转到自身的函数&nbsp;}<br>&nbsp;&nbsp;NewPorc[0][2]&nbsp;:=&nbsp;Tmp[1];<br>&nbsp;&nbsp;NewPorc[0][3]&nbsp;:=&nbsp;Tmp[2];<br>&nbsp;&nbsp;NewPorc[0][4]&nbsp;:=&nbsp;Tmp[3];<br>&nbsp;&nbsp;NewPorc[0][5]&nbsp;:=&nbsp;$FF;<br>&nbsp;&nbsp;NewPorc[0][6]&nbsp;:=&nbsp;$E0;<br>&nbsp;&nbsp;NewPorc[0][7]&nbsp;:=&nbsp;0;<br>而他的<br>&nbsp;&nbsp;DLLModule&nbsp;:=&nbsp;LoadLibrary('ws2_32.dll');&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>&nbsp;&nbsp;AddSend&nbsp;:=&nbsp;GetProcAddress(DLLModule,&nbsp;'send');&nbsp;&nbsp;//取得API地址<br>&nbsp;&nbsp;JmpCode.JmpCode&nbsp;:=&nbsp;$B8;<br>&nbsp;&nbsp;JmpCode.MovEAX[0]&nbsp;:=&nbsp;$FF;<br>&nbsp;&nbsp;JmpCode.MovEAX[1]&nbsp;:=&nbsp;$E0;<br>&nbsp;&nbsp;JmpCode.MovEAX[2]&nbsp;:=&nbsp;0;

代码，与你的有点像<br><br>HOOK.DLL的代码:<br>library&nbsp;Hook;<br><br>uses<br>&nbsp;&nbsp;SysUtils,<br>&nbsp;&nbsp;windows,<br>&nbsp;&nbsp;Messages,<br>&nbsp;&nbsp;APIHook&nbsp;in&nbsp;'APIHook.pas';<br><br>type<br>&nbsp;&nbsp;PData&nbsp;=&nbsp;^TData;<br>&nbsp;&nbsp;TData&nbsp;=&nbsp;record<br>&nbsp;&nbsp;&nbsp;&nbsp;Hook:&nbsp;THandle;<br>&nbsp;&nbsp;&nbsp;&nbsp;Hooked:&nbsp;Boolean;<br>&nbsp;&nbsp;end;<br>&nbsp;&nbsp;<br>var<br>&nbsp;&nbsp;DLLData:&nbsp;PData;<br><br>{------------------------------------}<br>{过程名:HookProc<br>{过程功能:HOOK过程<br>{过程参数:nCode,&nbsp;wParam,&nbsp;lParam消息的相<br>{&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;关参数<br>{------------------------------------}<br>procedure&nbsp;HookProc(nCode,&nbsp;wParam,&nbsp;lParam:&nbsp;LongWORD);stdcall;<br>begin<br>&nbsp;&nbsp;if&nbsp;not&nbsp;DLLData^.Hooked&nbsp;then<br>&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;HookAPI;<br>&nbsp;&nbsp;&nbsp;&nbsp;DLLData^.Hooked&nbsp;:=&nbsp;True;<br>&nbsp;&nbsp;end;<br>&nbsp;&nbsp;//调用下一个Hook<br>&nbsp;&nbsp;CallNextHookEx(DLLData^.Hook,&nbsp;nCode,&nbsp;wParam,&nbsp;lParam);<br>end;<br><br><br>{------------------------------------}<br>{函数名:InstallHook<br>{函数功能:在指定窗口上安装HOOK<br>{函数参数:sWindow:要安装HOOK的窗口<br>{返回值:成功返回TRUE,失败返回FALSE<br>{------------------------------------}<br>function&nbsp;InstallHook(SWindow:&nbsp;LongWORD):Boolean;stdcall;<br>var<br>&nbsp;&nbsp;ThreadID:&nbsp;LongWORD;<br>begin<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;False;<br>&nbsp;&nbsp;DLLData^.Hook&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;ThreadID&nbsp;:=&nbsp;GetWindowThreadProcessId(sWindow,&nbsp;nil);<br>&nbsp;&nbsp;//给指定窗口挂上钩子<br>&nbsp;&nbsp;DLLData^.Hook&nbsp;:=&nbsp;SetWindowsHookEx(WH_GETMESSAGE,&nbsp;@HookProc,&nbsp;Hinstance,&nbsp;ThreadID);<br>&nbsp;&nbsp;if&nbsp;DLLData^.Hook&nbsp;&gt;&nbsp;0&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;Result&nbsp;:=&nbsp;True&nbsp;&nbsp;//是否成功HOOK<br>&nbsp;&nbsp;else<br>&nbsp;&nbsp;&nbsp;&nbsp;exit;<br>end;<br><br>{------------------------------------}<br>{过程名:UnHook<br>{过程功能:卸载HOOK<br>{过程参数:无<br>{------------------------------------}<br>procedure&nbsp;UnHook;stdcall;<br>begin<br>&nbsp;&nbsp;UnHookAPI;<br>&nbsp;&nbsp;//卸载Hook<br>&nbsp;&nbsp;UnhookWindowsHookEx(DLLData^.Hook);<br>end;<br><br>{------------------------------------}<br>{过程名LL入口函数<br>{过程功能:进行DLL初始化,释放等<br>{过程参数LL状态<br>{------------------------------------}<br>procedure&nbsp;MyDLLHandler(Reason:&nbsp;Integer);<br>var<br>&nbsp;&nbsp;FHandle:&nbsp;LongWORD;<br>begin<br>&nbsp;&nbsp;case&nbsp;Reason&nbsp;of<br>&nbsp;&nbsp;&nbsp;&nbsp;DLL_PROCESS_ATTACH:<br>&nbsp;&nbsp;&nbsp;&nbsp;begin&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//建立文件映射,以实现DLL中的全局变量<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;FHandle&nbsp;:=&nbsp;CreateFileMapping($FFFFFFFF,&nbsp;nil,&nbsp;PAGE_READWRITE,&nbsp;0,&nbsp;$ffff,&nbsp;'MYDLLDATA');<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;FHandle&nbsp;=&nbsp;0&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;GetLastError&nbsp;=&nbsp;ERROR_ALREADY_EXISTS&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;FHandle&nbsp;:=&nbsp;OpenFileMapping(FILE_MAP_ALL_ACCESS,&nbsp;False,&nbsp;'MYDLLDATA');<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;FHandle&nbsp;=&nbsp;0&nbsp;then&nbsp;Exit;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end&nbsp;else&nbsp;Exit;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;DLLData&nbsp;:=&nbsp;MapViewOfFile(FHandle,&nbsp;FILE_MAP_ALL_ACCESS,&nbsp;0,&nbsp;0,&nbsp;0);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;DLLData&nbsp;=&nbsp;nil&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CloseHandle(FHandle);<br>&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;DLL_PROCESS_DETACH:<br>&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;Assigned(DLLData)&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;UnmapViewOfFile(DLLData);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;DLLData&nbsp;:=&nbsp;nil;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;end;<br>end;<br><br>{$R&nbsp;*.res}<br>exports<br>&nbsp;&nbsp;InstallHook,&nbsp;UnHook,&nbsp;HookProc;<br><br>begin<br>&nbsp;&nbsp;DLLProc&nbsp;:=&nbsp;@MyDLLHandler;<br>&nbsp;&nbsp;MyDLLhandler(DLL_PROCESS_ATTACH);<br>&nbsp;&nbsp;DLLData^.Hooked&nbsp;:=&nbsp;False;<br>end.<br><br>----------------------------------------------------------------------------------------<br>APIHook.Pas的代码:<br><br>unit&nbsp;APIHook;<br><br>interface<br><br>uses<br>&nbsp;&nbsp;SysUtils,<br>&nbsp;&nbsp;Windows,&nbsp;WinSock;<br><br>type<br>&nbsp;&nbsp;//要HOOK的API函数定义<br>&nbsp;&nbsp;TSockProc&nbsp;=&nbsp;function&nbsp;(s:&nbsp;TSocket;&nbsp;var&nbsp;Buf;&nbsp;len,&nbsp;flags:&nbsp;Integer):&nbsp;Integer;&nbsp;stdcall;<br><br>&nbsp;&nbsp;PJmpCode&nbsp;=&nbsp;^TJmpCode;<br>&nbsp;&nbsp;TJmpCode&nbsp;=&nbsp;packed&nbsp;record<br>&nbsp;&nbsp;&nbsp;&nbsp;JmpCode:&nbsp;BYTE;<br>&nbsp;&nbsp;&nbsp;&nbsp;Address:&nbsp;TSockProc;<br>&nbsp;&nbsp;&nbsp;&nbsp;MovEAX:&nbsp;Array&nbsp;[0..2]&nbsp;of&nbsp;BYTE;<br>&nbsp;&nbsp;end;<br><br>&nbsp;&nbsp;//--------------------函数声明---------------------------<br>&nbsp;&nbsp;procedure&nbsp;HookAPI;<br>&nbsp;&nbsp;procedure&nbsp;UnHookAPI;<br><br>var<br>&nbsp;&nbsp;OldSend,&nbsp;OldRecv:&nbsp;TSockProc;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//原来的API地址<br>&nbsp;&nbsp;JmpCode:&nbsp;TJmpCode;<br>&nbsp;&nbsp;OldProc:&nbsp;array&nbsp;[0..1]&nbsp;of&nbsp;TJmpCode;<br>&nbsp;&nbsp;AddSend,&nbsp;AddRecv:&nbsp;pointer;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//API地址<br>&nbsp;&nbsp;TmpJmp:&nbsp;TJmpCode;<br>&nbsp;&nbsp;ProcessHandle:&nbsp;THandle;<br>implementation<br><br>{---------------------------------------}<br>{函数功能:Send函数的HOOK<br>{函数参数:同Send<br>{函数返回值:integer<br>{---------------------------------------}<br>function&nbsp;MySend(s:&nbsp;TSocket;&nbsp;var&nbsp;Buf;&nbsp;len,&nbsp;flags:&nbsp;Integer):&nbsp;Integer;&nbsp;stdcall;<br>var<br>&nbsp;&nbsp;dwSize:&nbsp;cardinal;<br>begin<br>&nbsp;&nbsp;//这儿进行发送的数据处理<br>&nbsp;&nbsp;MessageBeep(1000);&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//简单的响一声<br>&nbsp;&nbsp;//调用直正的Send函数<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;AddSend,&nbsp;@OldProc[0],&nbsp;8,&nbsp;dwSize);<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;OldSend(S,&nbsp;Buf,&nbsp;len,&nbsp;flags);<br>&nbsp;&nbsp;JmpCode.Address&nbsp;:=&nbsp;@MySend;<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;AddSend,&nbsp;@JmpCode,&nbsp;8,&nbsp;dwSize);<br>end;<br><br>{---------------------------------------}<br>{函数功能:Recv函数的HOOK<br>{函数参数:同Recv<br>{函数返回值:integer<br>{---------------------------------------}<br>function&nbsp;MyRecv(s:&nbsp;TSocket;&nbsp;var&nbsp;Buf;&nbsp;len,&nbsp;flags:&nbsp;Integer):&nbsp;Integer;&nbsp;stdcall;<br>var<br>&nbsp;&nbsp;dwSize:&nbsp;cardinal;<br>begin<br>&nbsp;&nbsp;//这儿进行接收的数据处理<br>&nbsp;&nbsp;MessageBeep(1000);&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//简单的响一声<br>&nbsp;&nbsp;//调用直正的Recv函数<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;AddRecv,&nbsp;@OldProc[1],&nbsp;8,&nbsp;dwSize);<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;OldRecv(S,&nbsp;Buf,&nbsp;len,&nbsp;flags);<br>&nbsp;&nbsp;JmpCode.Address&nbsp;:=&nbsp;@MyRecv;<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;AddRecv,&nbsp;@JmpCode,&nbsp;8,&nbsp;dwSize);<br>end;<br><br>{------------------------------------}<br>{过程功能:HookAPI<br>{过程参数:无<br>{------------------------------------}<br>procedure&nbsp;HookAPI;<br>var<br>&nbsp;&nbsp;DLLModule:&nbsp;THandle;<br>&nbsp;&nbsp;dwSize:&nbsp;cardinal;<br>begin<br>&nbsp;&nbsp;ProcessHandle&nbsp;:=&nbsp;GetCurrentProcess;<br>&nbsp;&nbsp;DLLModule&nbsp;:=&nbsp;LoadLibrary('ws2_32.dll');&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>&nbsp;&nbsp;AddSend&nbsp;:=&nbsp;GetProcAddress(DLLModule,&nbsp;'send');&nbsp;&nbsp;//取得API地址<br>&nbsp;&nbsp;AddRecv&nbsp;:=&nbsp;GetProcAddress(DLLModule,&nbsp;'recv');<br>&nbsp;&nbsp;JmpCode.JmpCode&nbsp;:=&nbsp;$B8;<br>&nbsp;&nbsp;JmpCode.MovEAX[0]&nbsp;:=&nbsp;$FF;<br>&nbsp;&nbsp;JmpCode.MovEAX[1]&nbsp;:=&nbsp;$E0;<br>&nbsp;&nbsp;JmpCode.MovEAX[2]&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;ReadProcessMemory(ProcessHandle,&nbsp;AddSend,&nbsp;@OldProc[0],&nbsp;8,&nbsp;dwSize);<br>&nbsp;&nbsp;JmpCode.Address&nbsp;:=&nbsp;@MySend;<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;AddSend,&nbsp;@JmpCode,&nbsp;8,&nbsp;dwSize);&nbsp;&nbsp;&nbsp;//修改Send入口<br>&nbsp;&nbsp;ReadProcessMemory(ProcessHandle,&nbsp;AddRecv,&nbsp;@OldProc[1],&nbsp;8,&nbsp;dwSize);<br>&nbsp;&nbsp;JmpCode.Address&nbsp;:=&nbsp;@MyRecv;<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;AddRecv,&nbsp;@JmpCode,&nbsp;8,&nbsp;dwSize);&nbsp;&nbsp;&nbsp;//修改Recv入口<br>&nbsp;&nbsp;OldSend&nbsp;:=&nbsp;AddSend;<br>&nbsp;&nbsp;OldRecv&nbsp;:=&nbsp;AddRecv;<br>end;<br><br>{------------------------------------}<br>{过程功能:取消HOOKAPI<br>{过程参数:无<br>{------------------------------------}<br>procedure&nbsp;UnHookAPI;<br>var<br>&nbsp;&nbsp;dwSize:&nbsp;Cardinal;<br>begin<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;AddSend,&nbsp;@OldProc[0],&nbsp;8,&nbsp;dwSize);<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;AddRecv,&nbsp;@OldProc[1],&nbsp;8,&nbsp;dwSize);<br>end;<br><br>end.<br><br>---------------------------------------------------------------------------------------------<br>编译这个DLL后,再新建一个程序调用这个DLL的InstallHook并传入目标进程的主窗口句柄就可:<br>unit&nbsp;fmMain;<br><br>interface<br><br>uses<br>&nbsp;&nbsp;Windows,&nbsp;Messages,&nbsp;SysUtils,&nbsp;Variants,&nbsp;Classes,&nbsp;Graphics,&nbsp;Controls,&nbsp;Forms,<br>&nbsp;&nbsp;Dialogs,&nbsp;StdCtrls;<br><br>type<br>&nbsp;&nbsp;TForm1&nbsp;=&nbsp;class(TForm)<br>&nbsp;&nbsp;&nbsp;&nbsp;Button1:&nbsp;TButton;<br>&nbsp;&nbsp;&nbsp;&nbsp;Button2:&nbsp;TButton;<br>&nbsp;&nbsp;&nbsp;&nbsp;Edit1:&nbsp;TEdit;<br>&nbsp;&nbsp;&nbsp;&nbsp;procedure&nbsp;Button1Click(Sender:&nbsp;TObject);<br>&nbsp;&nbsp;&nbsp;&nbsp;procedure&nbsp;Button2Click(Sender:&nbsp;TObject);<br>&nbsp;&nbsp;private<br>&nbsp;&nbsp;&nbsp;&nbsp;{&nbsp;Private&nbsp;declarations&nbsp;}<br>&nbsp;&nbsp;public<br>&nbsp;&nbsp;&nbsp;&nbsp;{&nbsp;Public&nbsp;declarations&nbsp;}<br>&nbsp;&nbsp;end;<br>&nbsp;&nbsp;<br>var<br>&nbsp;&nbsp;Form1:&nbsp;TForm1;<br>&nbsp;&nbsp;InstallHook:&nbsp;function&nbsp;(SWindow:&nbsp;THandle):Boolean;stdcall;<br>&nbsp;&nbsp;UnHook:&nbsp;procedure;stdcall;<br>implementation<br><br>{$R&nbsp;*.dfm}<br><br>procedure&nbsp;TForm1.Button1Click(Sender:&nbsp;TObject);<br>var<br>&nbsp;&nbsp;ModuleHandle:&nbsp;THandle;<br>&nbsp;&nbsp;TmpWndHandle:&nbsp;THandle;<br>begin<br>&nbsp;&nbsp;TmpWndHandle&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;TmpWndHandle&nbsp;:=&nbsp;FindWindow(nil,&nbsp;'目标窗口的标题');<br>&nbsp;&nbsp;if&nbsp;not&nbsp;isWindow(TmpWndHandle)&nbsp;then<br>&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;MessageBox(self.Handle,&nbsp;'没有找到窗口',&nbsp;'!!!',&nbsp;MB_OK);<br>&nbsp;&nbsp;&nbsp;&nbsp;exit;<br>&nbsp;&nbsp;end;<br>&nbsp;&nbsp;ModuleHandle&nbsp;:=&nbsp;LoadLibrary('Hook.dll');<br>&nbsp;&nbsp;@InstallHook&nbsp;:=&nbsp;GetProcAddress(ModuleHandle,&nbsp;'InstallHook');<br>&nbsp;&nbsp;@UnHook&nbsp;:=&nbsp;GetProcAddress(ModuleHandle,&nbsp;'UnHook');<br>&nbsp;&nbsp;if&nbsp;InstallHook(FindWindow(nil,&nbsp;'Untitled'))&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;ShowMessage('Hook&nbsp;OK');<br>end;<br><br>procedure&nbsp;TForm1.Button2Click(Sender:&nbsp;TObject);<br>begin<br>&nbsp;&nbsp;UnHook<br>end;<br><br>end.

你在&nbsp;Hook&nbsp;之前把覆盖的代码&nbsp;Copy&nbsp;到&nbsp;OldProc&nbsp;应该就不会出错了。<br><br>不过老实说这段代码太差劲了。

要把原来的函数的地址先存起来<br>等HOOK结束后再赋值

不好意思,實在太菜了,請問如何儲存原來函數的地址?<br>&nbsp;ProcessHandle&nbsp;:=&nbsp;DWORD(-1);<br>&nbsp;&nbsp;DLLModule&nbsp;:=&nbsp;LoadLibrary('kernel32.dll');<br>&nbsp;&nbsp;{&nbsp;系统函数入口点地址&nbsp;}<br>&nbsp;&nbsp;BaseAddress[0]&nbsp;:=&nbsp;GetProcAddress(DLLModule,&nbsp;'CreateProcessW');<br>&nbsp;&nbsp;OldProc[0]:=BaseAddress[0];//是否在這裡這樣儲存?但如何將pointer轉為byte類型<br>&nbsp;&nbsp;Dat&nbsp;:=&nbsp;DWORD(@MyCreatePA);<br>&nbsp;&nbsp;........<br>&nbsp;&nbsp;..............

CopyMemory(@OldProc[0],&nbsp;@BaseAddress[0],&nbsp;长度);

厚著臉皮再問一下:<br>&nbsp;ProcessHandle&nbsp;:=&nbsp;DWORD(-1);<br>&nbsp;&nbsp;DLLModule&nbsp;:=&nbsp;LoadLibrary('kernel32.dll');<br>&nbsp;&nbsp;{&nbsp;系统函数入口点地址&nbsp;}<br>&nbsp;&nbsp;BaseAddress[0]&nbsp;:=&nbsp;GetProcAddress(DLLModule,&nbsp;'CreateProcessW');<br>&nbsp;&nbsp;CopyMemory(@OldProc[0],&nbsp;@BaseAddress[0],&nbsp;length(BaseAddress));//請問這樣做對嗎?UnHook後的問題依舊,是該長度設定有誤嗎?&nbsp;&nbsp;<br>&nbsp;&nbsp;Dat&nbsp;:=&nbsp;DWORD(@MyCreatePW);<br>&nbsp;&nbsp;........<br>&nbsp;&nbsp;..............

你这样的长度应该是4,而你的程序<br><br>WriteProcessMemory(ProcessHandle,&nbsp;AddSend,&nbsp;@OldProc[0],&nbsp;8,&nbsp;dwSize);<br><br>你说是多少?

http://www.51zhan.com&nbsp;最好的网址站&nbsp;<br>http://www.51zhan.com&nbsp;最好的网址站&nbsp;<br>http://www.51zhan.com&nbsp;最好的网址站

你的意思是直接賦值'8'嗎?<br>CopyMemory(@OldProc[0],&nbsp;@BaseAddress[0],&nbsp;8);//但結果還是一樣

楼主把所有的CopyMemory都换成WriteProcessMemory看看，我以前写过一个API&nbsp;HOOK程序，用了CopyMemory，在我自己的电脑上运行完全正常，但在别人的电脑上却会出错，后来我把所有的CopyMemory都换成WriteProcessMemory就不出错了，不知道你遇到的是不是和我同样的问题

還是不行呀,我有個疑問:<br><br>function&nbsp;MyCreatePW(lpApplicationName:&nbsp;PWideChar;&nbsp;lpCommandLine:&nbsp;PWideChar;&nbsp;//自定義函數<br>&nbsp;&nbsp;&nbsp;&nbsp;lpProcessAttributes,&nbsp;lpThreadAttributes:&nbsp;PSecurityAttributes;<br>&nbsp;&nbsp;&nbsp;&nbsp;bInheritHandles:&nbsp;BOOL;&nbsp;dwCreationFlags:&nbsp;DWORD;&nbsp;lpEnvironment:&nbsp;Pointer;<br>&nbsp;&nbsp;&nbsp;&nbsp;lpCurrentDirectory:&nbsp;PWideChar;&nbsp;const&nbsp;lpStartupInfo:&nbsp;TStartupInfo;<br>&nbsp;&nbsp;&nbsp;&nbsp;var&nbsp;lpProcessInformation:&nbsp;TProcessInformation):&nbsp;BOOL;&nbsp;stdcall;<br>var<br>&nbsp;&nbsp;nSize:&nbsp;Cardinal;<br>begin<br>&nbsp;&nbsp;MessageBoxW(0,&nbsp;lpCommandLine&nbsp;,lpApplicationName&nbsp;,&nbsp;0);//显示打开程序的命令行和文件名<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@OldProc[0],&nbsp;8,&nbsp;nSize);//這一句是修改成原來函數的地址,讓所有程序能正常打開<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;CreateProcessW(lpApplicationName,&nbsp;lpCommandLine,&nbsp;lpProcessAttributes,<br>&nbsp;&nbsp;&nbsp;lpThreadAttributes,&nbsp;bInheritHandles,&nbsp;dwCreationFlags,&nbsp;lpEnvironment,<br>&nbsp;&nbsp;&nbsp;lpCurrentDirectory,&nbsp;lpStartupInfo,&nbsp;lpProcessInformation);<br>&nbsp;&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@NewPorc[0],&nbsp;8,&nbsp;nSize);//在程序正常打開後再修改成自定義函數的地址,使所有程序在下次打開時都要先調用自定義函數<br>end;<br><br>既然在自定義函數中已可以修改成原來函數的地址,讓程序正常執行,為何在UnHook時使用同樣的&nbsp;WriteProcessMemory(ProcessHandle,&nbsp;BaseAddress[0],&nbsp;@OldProc[0],&nbsp;8,&nbsp;nSize);&nbsp;後卻會出錯呢?

出什么错,问问题说清楚点.

就還是本貼的問題:<br>在程序退出時調用UnHook,發現並無法恢復原來的Api,在開啟程序時會提示:<br>'&quot;0x02cacb54&quot;指令參考的&quot;0x02cacb54&quot;記憶體.該記憶體不能為&quot;read&quot;&nbsp;<br>按[確定]終止程序<br>按[取消]進行程序偵錯<br>請問如何解決?謝謝.