参考的这篇文章 http://blog.163.com/wuzhimin_1988/blog/static/1424760200856105011984/
我想把HOOK写在一个过程里,但是要出错呢
procedure MyFunc;
type
TImportCode = packed record
JumpInstruction: Word;
AddressOfPointerToFunction: ^Pointer;
end;
PImportCode = ^TImportCode;
type
TMessageA = function(hwn: hwnd; lptext: pchar; lpcapion: pchar; utype: cardinal):
integer; stdcall;
TMessageW = function(hwn: hwnd; lptext: pwidechar; lpcapion: pwidechar;
utype: cardinal): integer; stdcall;
var
i:Dword;
OldMessageBoxA: TMessageA;
OldMessageBoxW: TMessageW;
FuncMessageboxA, FuncMessageboxW: PImportCode;
//保存原地址
function TrueFunctionAddress(Code: Pointer): Pointer;
var func: PImportCode;
begin
Result := Code;
if Code = nil then exit;
try
func := code;
if (func.JumpInstruction=$25FF) then
begin
Result := func.AddressOfPointerToFunction;
end;
except
Result := nil;
end;
end;
//替换新地址
Function PermuteFunction(OldFunc,NewFunc:Pointer): Integer;
var
written: DWORD;
begin
WriteProcessMemory(GetCurrentProcess, OldFunc, @NewFunc, 4, written);
result := 1;
end;function MyBoxA(hwn:hwnd;lptext:pchar;lpcapion:pchar;utype:cardinal): integer; stdcall;
begin
result := OldMessageBoxA(hwn, 'Succes Hook A !', lpcapion, utype);
end;function MyBoxw(hwn:hwnd;lptext:pwidechar;lpcapion:pwidechar;utype:cardinal):
integer; stdcall;
begin
result := OldMessageBoxW(hwn, '成功挂上W!', lpcapion, utype);
end;//主过程开始
begin
FuncMessageboxA := @MessageboxA;
FuncMessageboxW := @MessageboxW;
//if @OldMessageBoxA = nil then
//这里OldMessageBoxA不等于nil 而放pas里的=nil
@OldMessageBoxA := TrueFunctionAddress(@messageboxA);
//if @OldMessageBoxW = nil then
//同上
@OldMessageBoxW := TrueFunctionAddress(@messageboxW);
PermuteFunction(FuncMessageboxA.AddressOfPointerToFunction, @MyBoxA);
PermuteFunction(FuncMessageboxW.AddressOfPointerToFunction, @MyBoxW);
end;
我想把HOOK写在一个过程里,但是要出错呢
procedure MyFunc;
type
TImportCode = packed record
JumpInstruction: Word;
AddressOfPointerToFunction: ^Pointer;
end;
PImportCode = ^TImportCode;
type
TMessageA = function(hwn: hwnd; lptext: pchar; lpcapion: pchar; utype: cardinal):
integer; stdcall;
TMessageW = function(hwn: hwnd; lptext: pwidechar; lpcapion: pwidechar;
utype: cardinal): integer; stdcall;
var
i:Dword;
OldMessageBoxA: TMessageA;
OldMessageBoxW: TMessageW;
FuncMessageboxA, FuncMessageboxW: PImportCode;
//保存原地址
function TrueFunctionAddress(Code: Pointer): Pointer;
var func: PImportCode;
begin
Result := Code;
if Code = nil then exit;
try
func := code;
if (func.JumpInstruction=$25FF) then
begin
Result := func.AddressOfPointerToFunction;
end;
except
Result := nil;
end;
end;
//替换新地址
Function PermuteFunction(OldFunc,NewFunc:Pointer): Integer;
var
written: DWORD;
begin
WriteProcessMemory(GetCurrentProcess, OldFunc, @NewFunc, 4, written);
result := 1;
end;function MyBoxA(hwn:hwnd;lptext:pchar;lpcapion:pchar;utype:cardinal): integer; stdcall;
begin
result := OldMessageBoxA(hwn, 'Succes Hook A !', lpcapion, utype);
end;function MyBoxw(hwn:hwnd;lptext:pwidechar;lpcapion:pwidechar;utype:cardinal):
integer; stdcall;
begin
result := OldMessageBoxW(hwn, '成功挂上W!', lpcapion, utype);
end;//主过程开始
begin
FuncMessageboxA := @MessageboxA;
FuncMessageboxW := @MessageboxW;
//if @OldMessageBoxA = nil then
//这里OldMessageBoxA不等于nil 而放pas里的=nil
@OldMessageBoxA := TrueFunctionAddress(@messageboxA);
//if @OldMessageBoxW = nil then
//同上
@OldMessageBoxW := TrueFunctionAddress(@messageboxW);
PermuteFunction(FuncMessageboxA.AddressOfPointerToFunction, @MyBoxA);
PermuteFunction(FuncMessageboxW.AddressOfPointerToFunction, @MyBoxW);
end;
根本就是垃圾级别的~用Mad好了~或者你自己写个