BYTE OldCode[9] = { 0x00, 0x00, 0x00, 0x00, 0x00 , 0x00 };
typedef void (*JumpToAddressFunc)(LPCWSTR);
JumpToAddressFunc jumpToAddressFunc = (void (*)(LPCWSTR))0x0041a000;
void UnHook()
{
DWORD OldProtect = 0;
LPVOID srcFuncAddress = (LPVOID)jumpToAddressFunc;
if (VirtualProtect((LPVOID)srcFuncAddress, 9, PAGE_EXECUTE_READWRITE, &OldProtect))
{
memcpy((LPVOID)srcFuncAddress, OldCode, sizeof(OldCode));
OutputDebugString(L"king:恢复模块成功。");
}
VirtualProtect((LPVOID)srcFuncAddress, 9, OldProtect, &OldProtect);
}
void Hook(LPVOID lpDstFunction)
{
OutputDebugString(L"king:加载模块成功。");
DWORD srcFuncAddress = (DWORD)jumpToAddressFunc;//(DWORD)GetProcAddress(hInstance, lpFuncName);
//DWORD srcFuncAddress = (DWORD)GetProcAddress(hInstance, lpFuncName);
DWORD OldProtect = 0;
if (VirtualProtect((LPVOID)srcFuncAddress, 9, PAGE_EXECUTE_READWRITE, &OldProtect))
{
memcpy(OldCode, (LPVOID)srcFuncAddress, 9); // 拷贝原始机器码指令
*(BYTE*)srcFuncAddress = 0xE9; //修改为JMP
uintptr_t ralativeAddress = (uintptr_t)lpDstFunction - (uintptr_t)srcFuncAddress - 5; //计算要跳转到的地址
WCHAR message[100];
wsprintfW(message, L"king:跳转到地址：0x%X", ralativeAddress);
OutputDebugString(message);
*(PINT32)(srcFuncAddress + 1) = ralativeAddress; // 填充90为指定跳转地址
*(BYTE*)(srcFuncAddress + 5) = 0x90;
*(BYTE*)(srcFuncAddress + 6) = 0x90;
*(BYTE*)(srcFuncAddress + 7) = 0x90;
*(BYTE*)(srcFuncAddress + 8) = 0x90;
}
else {
WCHAR message[100];
wsprintf(message, L"king:VirtualProtect失败。%d", srcFuncAddress);
OutputDebugString(message);
}
//memcpy((LPVOID)srcFuncAddress, &HookCode, sizeof(HookCode)); // 拷贝Hook机器指令
VirtualProtect((LPVOID)srcFuncAddress, 6, OldProtect, &OldProtect);
}
void
WINAPI
MySetTextContent(
LPCWSTR lpString)
{
UnHook();
MessageBox(0, lpString, lpString, MB_OK);
jumpToAddressFunc(lpString);
}
template<typename dst_type, typename src_type>
dst_type pointer_cast(src_type src)
{
return *static_cast<dst_type*>(static_cast<void*>(&src));
}
void CMFCApplication1Dlg::OnBnClickedButton1()
{
Hook((PROC)MySetTextContent);
SetTextContent(L"hello");
}
void CMFCApplication1Dlg::SetTextContent(LPCWSTR lpString)
{
SetDlgItemText(IDC_STATIC, lpString);
}
