-
-
[求助]hook recvfrom地址内存不能读?
-
发表于:
2008-12-20 12:24
4703
-
[求助]hook recvfrom地址内存不能读?
int WINAPI NewRecvFromAddr(SOCKET s,char* buf,int len,int flags,struct sockaddr* from,int* fromlen)
{
int n;
n = recvfrom(s,buf,len,flags,from,fromlen);
MessageBeep(MB_OK);
return(n);
}
.....
HMODULE hModule = LoadLibrary("WS2_32");
FARPROC OldRecvFromAddr = GetProcAddress(hModule,"recvfrom");
.....
VirtualProtectEx(hProc, OldRecvFromAddr, 5, PAGE_READWRITE,&dwId);
__asm
{
push eax;
push ebx;
mov eax,OldRecvFromAddr;
mov ebx,NewRecvFromAddr;
mov DWORD PTR DS:[eax],0xE9;
mov DWORD PTR DS:[eax+1],ebx;
pop ebx;
pop eax;
}
-----------------------------------------------------------------------------------------------
只实现获取包包数据的功能,运行程序后用OD看了WS2_32里的recvfrom的地址已变为JMP NewRecvFromAddr了,可一连接IPX就出现错误说是NewRecvFromAddr这个注入的地址是不可读的,这是为什么?
[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法