JMP跳转法 HOOK  CreateProcessInternalW  跳不回去...    大牛指点下....

///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
DWORD org_CreateProcessInternalW;

         
int __declspec(naked) __stdcall OrgCreateProcessInternalW(
        HANDLE hToken,
        LPCWSTR lpApplicationName,
        LPWSTR lpCommandLine,
        LPSECURITY_ATTRIBUTES lpProcessAttributes,
        LPSECURITY_ATTRIBUTES lpThreadAttributes,
        BOOL bInheritHandles,
        DWORD dwCreationFlags,
        LPVOID lpEnvironment,
        LPCWSTR lpCurrentDirectory,
        LPSTARTUPINFOW lpStartupInfo,
        LPPROCESS_INFORMATION lpProcessInformation,
        PHANDLE hNewToken
        )

{
        __asm {               ///////////////内嵌汇编这里出错了？  小弟汇编不是很懂啊！！！

                        mov edi,edi
                        push ebp
                        mov ebp,esp
                        jmp [org_CreateProcessInternalW]
        }
}

BOOL __stdcall MyCreateProcessInternalW(
        HANDLE hToken,
        LPCWSTR lpApplicationName,
        LPWSTR lpCommandLine,
        LPSECURITY_ATTRIBUTES lpProcessAttributes,
        LPSECURITY_ATTRIBUTES lpThreadAttributes,
        BOOL bInheritHandles,
        DWORD dwCreationFlags,
        LPVOID lpEnvironment,
        LPCWSTR lpCurrentDirectory,
        LPSTARTUPINFOW lpStartupInfo,
        LPPROCESS_INFORMATION lpProcessInformation,
        PHANDLE hNewToken
                                                                   )

{
int size1= WideCharToMultiByte(CP_ACP,0,lpApplicationName,-1, NULL, 0, NULL,0);
char * AsciiBuff =new char[size1];
WideCharToMultiByte(CP_ACP,0,lpApplicationName,-1,AsciiBuff,size1, NULL, 0);

MessageBox(NULL,AsciiBuff,"111111",MB_ICONINFORMATION);

BOOL ret=OrgCreateProcessInternalW(
        hToken,
lpApplicationName,
lpCommandLine,
lpProcessAttributes,
lpThreadAttributes,
bInheritHandles,
dwCreationFlags,
lpEnvironment,
lpCurrentDirectory,
lpStartupInfo,
lpProcessInformation,
hNewToken
);

return ret; ///////////////////////这里直接崩溃
}

BOOL WINAPI DllMain(HINSTANCE hinstModule, DWORD dwReason, LPVOID lpvReserved)
{
        if(dwReason == DLL_PROCESS_ATTACH)
        {

                DWORD oldflag;
                DWORD pCreateProcessInternalW = (DWORD)GetProcAddress(GetModuleHandle("kernel32.dll"), "CreateProcessInternalW");
        VirtualProtect((PVOID)pCreateProcessInternalW, 5, PAGE_EXECUTE_READWRITE, &oldflag);
        *(PCHAR)pCreateProcessInternalW = '\xE9';
            *(DWORD*)(pCreateProcessInternalW+1) = (DWORD)MyCreateProcessInternalW - (pCreateProcessInternalW+5);
            org_CreateProcessInternalW = pCreateProcessInternalW+ 5;
        }

        return true;
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！