BOOL Set_EAT_Hook(LPCWSTR lpModuleName,LPCSTR lpFuncName,LPVOID lpHookFunction,LPVOID* lpTrueFunction)
{
	LPVOID pBase = NULL;
	pBase = GetModuleHandleW(lpModuleName);
	if (NULL == pBase)
	{
		pBase = LoadLibraryW(lpModuleName);
		if (NULL == pBase)
		{
			return FALSE;
		}
	}
	PIMAGE_DOS_HEADER pDosHeader = NULL;
	PIMAGE_NT_HEADERS pNtHeader = NULL;
	PIMAGE_OPTIONAL_HEADER pOpHeader = NULL;
	PIMAGE_EXPORT_DIRECTORY pExportDes = NULL;
	pDosHeader = (PIMAGE_DOS_HEADER)pBase;
	if (IMAGE_DOS_SIGNATURE != pDosHeader->e_magic)
	{
		return FALSE;
	}
	pNtHeader = (PIMAGE_NT_HEADERS)((PBYTE)pBase + pDosHeader->e_lfanew);
	if (IMAGE_NT_SIGNATURE != pNtHeader->Signature)
	{
		return FALSE;
	}
	pOpHeader = (PIMAGE_OPTIONAL_HEADER)(&pNtHeader->OptionalHeader);
	pExportDes = (PIMAGE_EXPORT_DIRECTORY)((PBYTE)pBase + pOpHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
	PUCHAR pFuncName = NULL;
	PULONG pAddressOfFunctions=(ULONG*)((PBYTE)pBase + pExportDes->AddressOfFunctions); 
	PULONG pAddressOfNames=(ULONG*)((PBYTE)pBase + pExportDes->AddressOfNames); 
	PUSHORT pAddressOfNameOrdinals=(USHORT*)((PBYTE)pBase + pExportDes->AddressOfNameOrdinals); 

	ULONG uMax = pExportDes->NumberOfNames;
	USHORT index=0 ; 
	ULONG addr;
	for (ULONG uIndex = 0; uIndex <uMax;  uIndex++)
	{
		index=pAddressOfNameOrdinals[uIndex];
		addr=pAddressOfFunctions[index];
		pFuncName = (PUCHAR)( (PBYTE)pBase + pAddressOfNames[uIndex]);
		addr = pAddressOfFunctions[index];
		if(!_stricmp((const char*)pFuncName,lpFuncName))
		{
			*lpTrueFunction = (LPVOID)(pFuncName);
			ULONG uOldProtect;
			VirtualProtectEx(GetCurrentProcess(),&pAddressOfFunctions[index],4,PAGE_EXECUTE_READWRITE,&uOldProtect);
			pAddressOfFunctions[index]=(ULONG)((PBYTE)lpHookFunction - (PBYTE)pBase);
		}
	}
	return TRUE;
}

typedef int (WINAPI* P_MessageBoxW)(
				    _In_opt_  HWND hWnd,
				    _In_opt_  LPCWSTR lpText,
				    _In_opt_  LPCWSTR lpCaption,
				    _In_      UINT uType
				    );

typedef int (WINAPI* P_SHFileOperationW)(
	_Inout_  LPSHFILEOPSTRUCTW lpFileOp
	);

P_SHFileOperationW g_pSHFileOperationW = NULL;
P_MessageBoxW g_pMessageBoxW = NULL;

int WINAPI Fake_SHFileOperationW(
				 _Inout_  LPSHFILEOPSTRUCTW lpFileOp
				 )
{
	OutputDebugStringW(L"Fake_SHFileOperationW"); 
	return g_pSHFileOperationW(lpFileOp);
}

int WINAPI Fake_MessageBoxW(
			    _In_opt_  HWND hWnd,
			    _In_opt_  LPCWSTR lpText,
			    _In_opt_  LPCWSTR lpCaption,
			    _In_      UINT uType
			    )
{
	return g_pMessageBoxW(NULL,lpText,L"eat hook",uType);
}

BOOL MyShCopyFile(LPCWSTR lpInPath,LPCWSTR lpOutPath)
{
	SHFILEOPSTRUCTW  shFile;
	ZeroMemory (&shFile ,sizeof (shFile));
	shFile.pFrom = lpInPath;
	shFile.pTo = lpOutPath;
	shFile.wFunc = FO_COPY;
	shFile.fFlags = FOF_SILENT |FOF_ALLOWUNDO |FOF_NOCONFIRMATION;
	if (SHFileOperationW(&shFile) != 0 )
	{
		return FALSE ;
	}
	else
	{
		return TRUE ;
	} 
}

int _tmain(int argc, _TCHAR* argv[])
{
	BOOL bRet = Set_EAT_Hook(L"Shell32.dll","SHFileOperationW",Fake_SHFileOperationW,(LPVOID*)&g_pSHFileOperationW);
	bRet = Set_EAT_Hook(L"user32.dll","MessageBoxW",Fake_MessageBoxW,(LPVOID*)&g_pMessageBoxW);
	FARPROC address = GetProcAddress(GetModuleHandleW(L"shell32.dll"),"SHFileOperationW");
	FARPROC address2 = GetProcAddress(GetModuleHandleW(L"user32.dll"),"MessageBoxW");
	MyShCopyFile(L"c:\\1.txt",L"e:\\1.txt");
	MessageBoxW(NULL,L"xxxx",NULL,MB_OK);
	return 0;
}

[课程]FART 脱壳王！加量不加价！FART作者讲授！