利用在函数头写jmp，实现跳转到我的处理函数。为什么堆栈不平衡？恳请各位大牛帮助！
PS:按晕菜菜大牛修改后，esp是不出错了，
但会出现两次MessageBox。在反汇编窗口调试时，第一次Call MessageBoxA 后参数错了，MessageBox的内容也错了。第二次出现时则正常
希望大家帮忙！
#include <windows.h>
#include <stdio.h>
#define CODELEN 7
typedef struct _HOOKDATA_
{
BYTE OriCode[CODELEN];
BYTE HookCode[CODELEN];
PVOID OriAddr;
PVOID FakeAddr;
HANDLE hProc;
}HOOKDATA, *PHOOKDATA;
int InitHook(PHOOKDATA HookData, char *DllName, char *ExportName, PVOID FakeAddr)
{
// Set OriAddr
HookData->OriAddr = GetProcAddress(GetModuleHandle(DllName), ExportName);
if (HookData->OriAddr == 0)
{
return 1;
}
// Set hProc
HookData->hProc = OpenProcess(PROCESS_ALL_ACCESS, 0, GetCurrentProcessId());
if (!HookData->hProc)
{
return 2;
}
// Set FakeAddr
HookData->FakeAddr = FakeAddr;
// Set HookCode
HookData->HookCode[0] = 0xb8;
HookData->HookCode[5] = 0xff;
HookData->HookCode[6] = 0xe0;
memcpy((PVOID)(HookData->HookCode + 1), &(HookData->FakeAddr), 4);
return 0;
}
int SetHook(PHOOKDATA HookData)
{
DWORD dwTmp;
// Set the attribute of memory
if (!VirtualProtect(HookData->OriAddr, CODELEN, PAGE_EXECUTE_READWRITE, &dwTmp))
{
return 1;
}
// Return the original data
if (!ReadProcessMemory(HookData->hProc, HookData->OriAddr, HookData->OriCode, CODELEN, NULL))
{
return 2;
}
// Write the head of function
if (!WriteProcessMemory(HookData->hProc, HookData->OriAddr, HookData->HookCode, CODELEN, NULL))
{
return 3;
}
return 0;
}
int RemoveHook(PHOOKDATA HookData)
{
if (!WriteProcessMemory(HookData->hProc, HookData->OriAddr, HookData->OriCode, CODELEN, NULL))
{
return 1;
}
return 0;
}
// WINAPI 已按晕菜菜大牛的要求添加
HANDLE [COLOR="Red"]WINAPI [/COLOR]MyOpenProcess(
DWORD dwDesiredAccess,
BOOL bInheritHandle,
DWORD dwProcessId
)
{
char buf[255];
sprintf(buf, "Acc:%ld\nInh:%ld\nPID:%d\n", dwDesiredAccess, bInheritHandle, dwProcessId);
MessageBox(NULL, buf, "Wonderful!", 0);
// 已按晕菜菜大牛删除
//__asm
//{
// sub esp,12
//}
return 0;
}
int main()
{
HOOKDATA HookData;
memset(&HookData, 0, sizeof(HOOKDATA));
printf("Init:%d\n", InitHook(&HookData, "kernel32.dll", "OpenProcess", MyOpenProcess));
printf("Set:%d\n", SetHook(&HookData));
OpenProcess(1, 2, 3);
}
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
