-
-
[原创]算不算Inline Patch
-
发表于:
2013-6-25 20:07
7860
-
//以挂起的方式启动进程
PROCESS_INFORMATION pi;
STARTUPINFO si;
memset(&pi,0,sizeof(pi));
memset(&si,0,sizeof(si));
BOOL lRet= CreateProcess("test.exe",NULL,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&si,&pi);
if (lRet==FALSE)
{
MessageBoxA(0,"Not Find File!",0,0);
return;
}
BYTE command[]={0xEB,0xFE};//2个字节让代码一直jmp当前地址
HMODULE hModule=GetModuleHandle("user32.dll");
FARPROC lApi=GetProcAddress(hModule,"CreateWindowExA");//以CreateWindowExA为例
WriteProcessMemory(pi.hProcess,(LPVOID)lApi,&command,2,NULL);//向API写入EBFE
ResumeThread(pi.hThread);//恢复线程
BYTE OldApi[2]={0x8B,0xFF};
CONTEXT context;
context.ContextFlags=CONTEXT_FULL;
while(1)//等待到达CreateWindowExA
{
GetThreadContext(pi.hThread,&context);
if (context.Eip==(UINT)lApi)
{
SuspendThread(pi.hThread);//当到达API时,挂起进程
break;
}
}
//此处进行Patch
WriteProcessMemory(hProcess,(LPVOID)lApi,&OldApi,1,NULL);//恢复原指令
ResumeThread(pi.hThread);
[招生]科锐逆向工程师培训(2024年11月15日实地,远程教学同时开班, 第51期)