// (c) Code By Extreme
// Description:Ring3 Api hook engine(by EAT)
// Last update:2010-4-16
HANDLE WINAPI MyOpenProcess( DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId)
{
MessageBox(NULL, "Call!", "wonderful!", 0);
}
DWORD GetDllBaseAddr(char *DllName)
{
HANDLE hToolHelp;
MODULEENTRY32 ModEntry;
hToolHelp = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, GetCurrentProcessId());
if (hToolHelp == INVALID_HANDLE_VALUE)
{
return 0;
}
if (!Module32First(hToolHelp, &ModEntry))
{
return 0;
}
while (Module32Next(hToolHelp, &ModEntry))
{
if (!strcmp(ModEntry.szModule, DllName))
{
CloseHandle(hToolHelp);
return (DWORD)ModEntry.modBaseAddr;
}
}
return 0;
CloseHandle(hToolHelp);
}
PVOID GetEAT(char *DllName, char *ExpName)
{
PVOID Pointer;
DWORD DllBaseAddr;
PIMAGE_EXPORT_DIRECTORY ExpDir;
PDWORD AddrOfNames;
PDWORD AddrOfFuncs;
PUSHORT AddrOfOrdinals;
DWORD Cnt;
DWORD Max;
PDWORD AddrToWrite;
DWORD dwTmp;
BYTE DataToWrite[4];
DllBaseAddr = GetDllBaseAddr(DllName);
if (DllBaseAddr == 0)
{
return 0;
}
// IMAGE_DOS_HEADER
Pointer = (PVOID)DllBaseAddr;
if (Pointer == 0)
{
return 0;
}
// IMAGE_NT_HEADERS
Pointer = (PVOID)((DWORD)((PIMAGE_DOS_HEADER)Pointer)->e_lfanew + DllBaseAddr);
if (Pointer == 0)
{
return 0;
}
// IMAGE_EXPORT_DIRECTORY
ExpDir = (PIMAGE_EXPORT_DIRECTORY)((DWORD)(((PIMAGE_NT_HEADERS)(Pointer))->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress) + DllBaseAddr);
AddrOfNames = (PDWORD)((DWORD)ExpDir->AddressOfNames + DllBaseAddr);
AddrOfFuncs = (PDWORD)((DWORD)ExpDir->AddressOfFunctions + DllBaseAddr);
AddrOfOrdinals = (PWORD)((DWORD)ExpDir->AddressOfNameOrdinals + DllBaseAddr);
Max = ExpDir->NumberOfNames;
for (Cnt = 0; Cnt < Max; ++Cnt)
{
if (!strcmp((PUCHAR)(AddrOfNames[Cnt] + DllBaseAddr), ExpName))
{
dwTmp = (DWORD)MyOpenProcess - DllBaseAddr;
memcpy(DataToWrite, &dwTmp, sizeof(DWORD));
AddrToWrite = &AddrOfFuncs[AddrOfOrdinals[Cnt]];
if (!VirtualProtect(AddrToWrite, sizeof(DWORD), PAGE_EXECUTE_READWRITE, &dwTmp))
{
return 0;
}
WriteProcessMemory(GetCurrentProcess(), (PDWORD)AddrToWrite, DataToWrite, sizeof(DWORD), &dwTmp);
if (dwTmp != sizeof(DWORD))
{
return 0;
}
return 0;
}
}
return 0;
}
int main()
{
PVOID Addr;
Addr = GetEAT("kernel32.dll", "OpenProcess");
Addr = (DWORD)OpenProcess;
return 0;
}
这里面的这个GetDllBaseAddr你写的的这个用LoadLIbraryA一下就实现了，而且兼容性还相当的不错 你写了那么多 太浪费金钱和时间了 时间是用来享受生活的 明天估计会出太阳 有空跟我去钓鱼吧 哈哈
修改的是当前进程 为什么不用指针操作呢
