WriteProcessMemory写入时内存时,调用的程序崩溃,为何??? ( 积分: 100 )

这是原函数声明:<br>type<br>&nbsp;&nbsp;TZwQueryDirectoryFileNextHook&nbsp;=&nbsp;function(FileHandle:&nbsp;THANDLE;&nbsp;Event:&nbsp;THANDLE;<br>&nbsp;&nbsp;&nbsp;&nbsp;ApcRoutine:&nbsp;PIO_APC_ROUTINE;&nbsp;ApcContext:&nbsp;pointer;&nbsp;IoStatusBlock:<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PIO_STATUS_BLOCK;<br>&nbsp;&nbsp;&nbsp;&nbsp;FileInformation:&nbsp;PVOID;&nbsp;FileInformationLength:&nbsp;ULONG;&nbsp;FileInformationClass:<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;FILE_INFORMATION_CLASS;<br>&nbsp;&nbsp;&nbsp;&nbsp;ReturnSingleEntry:&nbsp;BOOLEAN;&nbsp;FileName:&nbsp;PUNICODE_STRING;&nbsp;RestartScan:<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;BOOLEAN):&nbsp;DWORD;&nbsp;stdcall;<br><br>替换的函数<br>function&nbsp;SundyNtQueryDirectoryFile(FileHandle:&nbsp;THANDLE;&nbsp;Event:&nbsp;THANDLE;<br>&nbsp;&nbsp;ApcRoutine:&nbsp;PIO_APC_ROUTINE;&nbsp;ApcContext:&nbsp;pointer;&nbsp;IoStatusBlock:<br>&nbsp;&nbsp;&nbsp;&nbsp;PIO_STATUS_BLOCK;<br>&nbsp;&nbsp;FileInformation:&nbsp;PVOID;&nbsp;FileInformationLength:&nbsp;ULONG;&nbsp;FileInformationClass:<br>&nbsp;&nbsp;&nbsp;&nbsp;FILE_INFORMATION_CLASS;<br>&nbsp;&nbsp;ReturnSingleEntry:&nbsp;BOOLEAN;&nbsp;FileName:&nbsp;PUNICODE_STRING;&nbsp;RestartScan:&nbsp;BOOLEAN):<br>&nbsp;&nbsp;&nbsp;&nbsp;DWORD;&nbsp;stdcall;<br>var<br>&nbsp;&nbsp;P:&nbsp;Pointer;<br>&nbsp;&nbsp;Curr,&nbsp;Prev:&nbsp;PFILE_BOTH_DIRECTORY_INFORMATION;<br>&nbsp;&nbsp;i:&nbsp;integer;<br>&nbsp;&nbsp;PW:&nbsp;PWideChar;<br>&nbsp;&nbsp;FNI:&nbsp;PFILE_NAME_INFORMATION;<br>begin<br>&nbsp;&nbsp;try<br>&nbsp;&nbsp;&nbsp;&nbsp;WriteLog('c:/debug.txt',&nbsp;'SundyNtQueryDirectoryFile执行了');<br>&nbsp;&nbsp;&nbsp;&nbsp;P&nbsp;:=&nbsp;RestoreApiProc(1);<br>&nbsp;&nbsp;&nbsp;&nbsp;result&nbsp;:=&nbsp;TZwQueryDirectoryFileNextHook(P)(FileHandle,&nbsp;Event,&nbsp;ApcRoutine,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ApcContext,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;IoStatusBlock,&nbsp;FileInformation,&nbsp;FileInformationLength,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;FileInformationClass,&nbsp;ReturnSingleEntry,&nbsp;FileName,&nbsp;RestartScan);<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;FileBothDirectoryInformation&nbsp;=&nbsp;FileInformationClass&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Prev&nbsp;:=&nbsp;nil;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Curr&nbsp;:=&nbsp;PFILE_BOTH_DIRECTORY_INFORMATION(FileInformation);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;while&nbsp;Curr^.NextEntryOffset&nbsp;&gt;&nbsp;0&nbsp;do<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;isHideFile(<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PWideChar(DWORD(@PFILE_BOTH_DIRECTORY_INFORMATION(Curr)^.FileName[0])<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+&nbsp;1)<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp&nbsp;and&nbsp;(Curr^.FileAttributes&nbsp;=&nbsp;16)&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;Curr^.NextEntryOffset&nbsp;=&nbsp;0&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;Prev&nbsp;=&nbsp;nil&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Prev^.NextEntryOffset&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;break;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Prev^.NextEntryOffset&nbsp;:=&nbsp;Prev^.NextEntryOffset&nbsp;+<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Curr^.NextEntryOffset;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;DWORD(Curr)&nbsp;:=&nbsp;DWORD(Curr)&nbsp;+&nbsp;Curr^.NextEntryOffset;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;else<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Prev&nbsp;:=&nbsp;Curr;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;DWORD(Curr)&nbsp;:=&nbsp;DWORD(Curr)&nbsp;+&nbsp;Curr^.NextEntryOffset;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;SundyTools.ReplaceApiProc(PID,&nbsp;P,&nbsp;@SundyNtQueryDirectoryFile,&nbsp;1);<br>&nbsp;&nbsp;&nbsp;&nbsp;FDHooked&nbsp;:=&nbsp;TRUE;<br>&nbsp;&nbsp;except<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;FDHooked&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SundyTools.RestoreApiProc(1);<br>&nbsp;&nbsp;&nbsp;&nbsp;FDHooked&nbsp;:=&nbsp;FALSE;<br>&nbsp;&nbsp;end;<br>&nbsp;&nbsp;WriteLog('c:/debug.txt',&nbsp;'SundyNtQueryDirectoryFile执行了');<br><br>end;<br>&nbsp;SundyTools.RestoreApiProc函数:<br>function&nbsp;ReplaceApiProc(ProcessId:&nbsp;DWORD;&nbsp;OldP:&nbsp;Pointer;&nbsp;NewP:&nbsp;Pointer;&nbsp;index:&nbsp;integer):&nbsp;Pointer;<br>var<br>&nbsp;&nbsp;R:&nbsp;DWORD;<br>&nbsp;&nbsp;old,Newointer;<br>begin<br>&nbsp;&nbsp;try<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;OldP;<br>&nbsp;&nbsp;ss.JmpCode&nbsp;:=$B8;<br>&nbsp;&nbsp;ss.Address&nbsp;:=NewP;<br>&nbsp;&nbsp;ss.MovEAX[0]&nbsp;:=&nbsp;$FF;<br>&nbsp;&nbsp;ss.MovEAX[1]&nbsp;:=&nbsp;$E0;<br>&nbsp;&nbsp;ss.MovEAX[2]&nbsp;:=&nbsp;0;<br>&nbsp;//保存原函数地址<br>&nbsp;&nbsp;OldAdd[index]:=dword(oldp);<br>//读取缓存区<br>&nbsp;&nbsp;&nbsp;&nbsp;old:=Pointer(@ReplaceCode[index][0]);<br>&nbsp;&nbsp;&nbsp;&nbsp;new:=@ss;<br>&nbsp;&nbsp;&nbsp;WriteLog('c:/SundyTools.txt','old:&nbsp;'+inttostr(dword(old))+'New:&nbsp;'+inttostr(dword(New)));<br>&nbsp;&nbsp;&nbsp;WriteLog('c:/SundyTools.txt','oldp:&nbsp;'+inttostr(dword(oldp))+'Newp:&nbsp;'+inttostr(dword(Newp)));<br><br>&nbsp;&nbsp;&nbsp;WriteLog('c:/SundyTools.txt','ReadProcessMemory开始执行');<br><br>&nbsp;&nbsp;&nbsp;&nbsp;ReadProcessMemory(ProcessId&nbsp;,&nbsp;OldP,&nbsp;old,&nbsp;8,&nbsp;R);<br>&nbsp;&nbsp;&nbsp;&nbsp;WriteLog('c:/SundyTools.txt','ReadProcessMemory执行了');<br>&nbsp;&nbsp;&nbsp;WriteLog('c:/SundyTools.txt','WriteProcessMemory开始执行');<br><br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;WriteProcessMemory(ProcessId&nbsp;,&nbsp;OldP,New,8,&nbsp;R);<br>&nbsp;&nbsp;&nbsp;&nbsp;WriteLog('c:/SundyTools.txt','WriteProcessMemory执行了');<br><br>&nbsp;&nbsp;&nbsp;&nbsp;PReplaceEx(@ReplaceCode[index][0])^.processId&nbsp;:=&nbsp;ProcessId;<br>&nbsp;&nbsp;except<br>&nbsp;&nbsp;&nbsp;&nbsp;OutputDebugString(pchar('ReplaceApiProc&nbsp;Function&nbsp;Error'));<br>&nbsp;&nbsp;end;<br>end;<br>在网上找不到相关的资料,请高手帮忙解决一下吧

为什么没有人回答??高手哪去了

ss.JmpCode&nbsp;:=$B8;&nbsp;<br>这里不对吧？$B8可不是JMP，是不是应该是$E8、$E9啊？

所能的HookApi都是这个,这个可能有错吗

没错，它是用JMP&nbsp;EAX来做的，是MOV&nbsp;EAX，&nbsp;xxxx,&nbsp;JMP&nbsp;EAX<br>不是这个原因

我现在测试只有钩ZwQueryDirectoryFile这个函数时,WriteProcessMemory写入内存时会崩溃,为什么这么长时间,没有一个有效的答复,大富翁怎么了??

这么久了,还是没有人能解答吗?

如果方便的话你可以把代码发到我邮箱，有空看看，tseug@263.net