-
-
[求助]hook recvfrom地址内存不能读?
-
发表于:
2008-12-20 12:24
4797
-
[求助]hook recvfrom地址内存不能读?
int WINAPI NewRecvFromAddr(SOCKET s,char* buf,int len,int flags,struct sockaddr* from,int* fromlen)
{
int n;
n = recvfrom(s,buf,len,flags,from,fromlen);
MessageBeep(MB_OK);
return(n);
}
.....
HMODULE hModule = LoadLibrary("WS2_32");
FARPROC OldRecvFromAddr = GetProcAddress(hModule,"recvfrom");
.....
VirtualProtectEx(hProc, OldRecvFromAddr, 5, PAGE_READWRITE,&dwId);
__asm
{
push eax;
push ebx;
mov eax,OldRecvFromAddr;
mov ebx,NewRecvFromAddr;
mov DWORD PTR DS:[eax],0xE9;
mov DWORD PTR DS:[eax+1],ebx;
pop ebx;
pop eax;
}
-----------------------------------------------------------------------------------------------
只实现获取包包数据的功能,运行程序后用OD看了WS2_32里的recvfrom的地址已变为JMP NewRecvFromAddr了,可一连接IPX就出现错误说是NewRecvFromAddr这个注入的地址是不可读的,这是为什么?
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入!