BOOL WINAPI MyWriteProcessMemory(
  HANDLE hProcess,              // handle to process
LPVOID lpBaseAddress,          // base of memory area
LPVOID lpBuffer,              // data buffer
DWORD nSize,                  // number of bytes to write
LPDWORD lpNumberOfBytesWritten // number of bytes written
);
DETOUR_TRAMPOLINE(BOOL WINAPI CopyWriteProcessMemory(HANDLE, LPVOID, LPVOID, DWORD, LPDWORD), WriteProcessMemory);
BOOL WINAPI MyWriteProcessMemory(
HANDLE hProcess,              // handle to process
LPVOID lpBaseAddress,          // base of memory area
LPVOID lpBuffer,              // data buffer
DWORD nSize,                  // number of bytes to write
LPDWORD lpNumberOfBytesWritten) // number of bytes written
{
  BOOL nResult=CopyWriteProcessMemory(hProcess,lpBaseAddress,lpBaseAddress,nSize,lpNumberOfBytesWritten);    
MessageBoxA(NULL,(LPCTSTR)lpBaseAddress,"Hook!",MB_OK);  
return nResult;
} 

BOOL APIENTRY DllMain( HANDLE hModule, 
                      DWORD  ul_reason_for_call, 
                      LPVOID lpReserved
                    )
{
    switch (ul_reason_for_call)
    {
        case DLL_PROCESS_ATTACH:
            OutputDebugString("Detour dll Load!");
            DetourFunctionWithTrampoline((PBYTE)CopyWriteProcessMemory, (PBYTE)MyWriteProcessMemory);
            break;
        case DLL_THREAD_ATTACH:
            break;
        case DLL_THREAD_DETACH:
            break;
        case DLL_PROCESS_DETACH:
            OutputDebugString("Detour dll Exit!");
            DetourRemove((PBYTE)CopyWriteProcessMemory, (PBYTE)MyWriteProcessMemory);
            break;
    }
    return TRUE;
}

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)