在这里我将要实现转跳。有人说修改内存内容要进入Ring 0 才可以。可是Windows本身提供了一个写内存的指令WriteProcessMemory。有了这把利器，我们几乎无所不能。如游戏的修改等在这里我们只谈APIHOOK。function RepointFunction(OldFunc, NewFunc: Pointer): Integer;var IsDone: TList; function RepointAddrInModule(hModule: THandle; OldFunc, NewFunc: Pointer): Integer; var Dos: PImageDosHeader; NT: PImageNTHeaders; ImportDesc: PImage_Import_Entry; RVA: DWORD; Func: ^Pointer; DLL: string; f: Pointer; written: DWORD; begin Result := 0; Dos := Pointer(hModule); if IsDone.IndexOf(Dos) >= 0 then exit; IsDone.Add(Dos);
OldFunc := LocateFunctionAddress(OldFunc);
if IsBadReadPtr(Dos, SizeOf(TImageDosHeader)) then exit; if Dos.e_magic <> IMAGE_DOS_SIGNATURE then exit; NT := Pointer(Integer(Dos) + dos._lfanew);
RVA := NT^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT] .VirtualAddress;
if RVA = 0 then exit; ImportDesc := pointer(integer(Dos) + RVA); while (ImportDesc^.Name <> 0) do begin DLL := PChar(Integer(Dos) + ImportDesc^.Name); RepointAddrInModule(GetModuleHandle(PChar(DLL)), OldFunc, NewFunc); Func := Pointer(Integer(DOS) + ImportDesc.LookupTable); while Func^ <> nil do begin f := LocateFunctionAddress(Func^); if f = OldFunc then begin WriteProcessMemory(GetCurrentProcess, Func, @NewFunc, 4, written); if Written > 0 then Inc(Result); end; Inc(Func); end; Inc(ImportDesc); end; end;
begin IsDone := TList.Create; try Result := RepointAddrInModule(GetModuleHandle(nil), OldFunc, NewFunc); finally IsDone.Free; end;end;有了这两个函数我们几乎可以更改任何API函数。我们可以先写一个DLL文件。我这里以修改Text相关函数为例：先定义几个函数：type TTextOutA = function(DC: HDC; X, Y: Integer; Str: PAnsiChar; Count: Integer): BOOL; stdcall; TTextOutW = function(DC: HDC; X, Y: Integer; Str: PWideChar; Count: Integer): BOOL; stdcall; TTextOut = function(DC: HDC; X, Y: Integer; Str: PChar; Count: Integer): BOOL; stdcall; TDrawTextA = function(hDC: HDC; lpString: PAnsiChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall; TDrawTextW = function(hDC: HDC; lpString: PWideChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall; TDrawText = function(hDC: HDC; lpString: PChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall;var OldTextOutA: TTextOutA; OldTextOutW: TTextOutW; OldTextOut: TTextOut; OldDrawTextA: TDrawTextA; OldDrawTextW: TDrawTextW; OldDrawText: TDrawText;......function MyTextOutA(DC: HDC; X, Y: Integer; Str: PAnsiChar; Count: Integer): BOOL; stdcall;begin OldTextOutA(DC, X, Y, 'ABC', length('ABC'));end;
function MyTextOutW(DC: HDC; X, Y: Integer; Str: PWideChar; Count: Integer): BOOL; stdcall;begin OldTextOutW(DC, X, Y, 'ABC', length('ABC'));end;
function MyTextOut(DC: HDC; X, Y: Integer; Str: PChar; Count: Integer): BOOL; stdcall;begin OldTextOut(DC, X, Y, 'ABC', length('ABC'));end;
function MyDrawTextA(hDC: HDC; lpString: PAnsiChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall;begin OldDrawTextA(hDC, 'ABC', length('ABC'), lpRect, uFormat);end;
function MyDrawTextW(hDC: HDC; lpString: PWideChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall;begin OldDrawTextW(hDC, 'ABC', length('ABC'), lpRect, uFormat);end;
function MyDrawText(hDC: HDC; lpString: PChar; nCount: Integer; var lpRect: TRect; uFormat: UINT): Integer; stdcall;begin OldDrawText(hDC, 'ABC', length('ABC'), lpRect, uFormat);end;
调用时我们要把原来的函数地址保存下来： if @OldTextOutA = nil then @OldTextOutA := LocateFunctionAddress(@TextOutA); if @OldTextOutW = nil then @OldTextOutW := LocateFunctionAddress(@TextOutW); if @OldTextOut = nil then @OldTextOut := LocateFunctionAddress(@TextOut); if @OldDrawTextA = nil then @OldDrawTextA := LocateFunctionAddress(@DrawTextA); if @OldDrawTextW = nil then @OldDrawTextW := LocateFunctionAddress(@DrawTextW); if @OldDrawText = nil then @OldDrawText := LocateFunctionAddress(@DrawText);然后很顺其自然的用自己的函数替换掉原来的函数 RepointFunction(@OldTextOutA, @MyTextOutA); RepointFunction(@OldTextOutW, @MyTextOutW); RepointFunction(@OldTextOut, @MyTextOut); RepointFunction(@OldDrawTextA, @MyDrawTextA); RepointFunction(@OldDrawTextW, @MyDrawTextW); RepointFunction(@OldDrawText, @MyDrawText); 在结束时不要忘记恢复原来函数的入口，要不然你会死得很难看哟！好了我们在写一个Demo程序。你会说怎么文字没有变成ABC呀？是呀，你要刷新一下才行。最小化然后在最大化。看看变了没有。 要不然你就写代码刷新一下好了。至于去拦截其他进程的API那就用SetWindowsHookEx写一个其他的钩子将DLL映射进去就行了，我就不再浪费口水了。掌握了该方法你几乎无所不能。你可以修改其它程序。你可以拦截Createwindow等窗口函数改变其他程序的窗口形状、你还可以入侵其它的程序，你还可以......嘿嘿。干了坏事别招出我来就行了。我还写了个例子，请在上下载。
