以前的账号丢了，写两行代码看看能不能要个邀请码
老生长谈了。。。。。。。。。。。。。

陷阱式

program Project2;
{$APPTYPE CONSOLE}
uses
  SysUtils, Windows;
type
  TMessageBox = function(hwnd: HWND; lpText: PChar; lpCaption: PChar; uType:
    Cardinal):
    integer; stdcall;
  TMessageBoxA = function(hwnd: HWND; lpText: PAnsiChar; lpCaption: PAnsiChar;
    uType: Cardinal):
    integer; stdcall;
  TMessageBoxW = function(hwnd: HWND; lpText: PWideChar; lpCaption: PWideChar;
    uType: Cardinal):
    integer; stdcall;
var
  baseAddress: pointer;
  OldEntry, NewEntry: array[0..7] of Byte;
  pA, pW: Pointer;
function MyBox(hwnd: HWND; lpText: PChar; lpCaption: PChar; uType:
  Cardinal):
  integer; stdcall;
var
  dwSize: DWORD;
begin
  WriteProcessMemory(GetCurrentProcess, pA, @OldEntry, 8, dwSize);
  Result := MessageBoxA(hwnd, lpText, 'Hook Api A', uType);
  WriteProcessMemory(GetCurrentProcess, pA, @NewEntry, 8, dwSize);
end;
function MyBoxA(hwnd: HWND; lpText: PAnsiChar; lpCaption: PAnsiChar; uType:
  Cardinal):
  integer; stdcall;
var
  dwSize: DWORD;
begin
  WriteProcessMemory(GetCurrentProcess, pA, @OldEntry, 8, dwSize);
  Result := MessageBoxA(hwnd, lpText, 'Hook Api A', uType);
  WriteProcessMemory(GetCurrentProcess, pA, @NewEntry, 8, dwSize);
end;
function MyBoxW(hwnd: HWND; lpText: PWideChar; lpCaption: PWideChar; uType:
  Cardinal):
  integer; stdcall;
var
  dwSize: DWORD;
begin
  WriteProcessMemory(GetCurrentProcess, pW, @OldEntry, 8, dwSize);
  Result := MessageBoxW(hwnd, lpText, 'Hook Api W', uType);
  WriteProcessMemory(GetCurrentProcess, pW, @NewEntry, 8, dwSize);
end;
procedure HookApi(Module: PChar; FunName: Pchar; NewFun: Pointer; var
  baseAddress:
  Pointer);
var
  MyFun, dwReadSize: DWORD;
  Addr: array[0..3] of BYTE;
begin
  baseAddress := GetProcAddress(GetModulehandle(Module), FunName);
  if baseAddress = nil then
    exit;
  MyFun := DWORD(NewFun);
  Move(MyFun, Addr, 4);
  NewEntry[0] := $B8;
  NewEntry[1] := Addr[0];
  NewEntry[2] := Addr[1];
  NewEntry[3] := Addr[2];
  NewEntry[4] := Addr[3]; //mov ax,addr
  NewEntry[5] := $FF;
  NewEntry[6] := $E0; //jmp ax
  NewEntry[7] := 0;
  //读取原始头部
  if ReadProcessMemory(GetCurrentProcess(), baseAddress, @OldEntry, 8,
    dwReadSize) then
  begin
    VirtualProtectEx(GetCurrentProcess(), baseAddress, 0, PAGE_READWRITE,
      nil);
    //可写
    dwReadSize := 0;
    WriteProcessMemory(GEtCurrentProcess(), baseAddress, @NewEntry, 8,
      dwReadSize);
  end;
end;
begin
  HookApi(PChar('user32.dll'), PChar('MessageBoxA'), @MyBoxA, pA);
  HookApi(PChar('user32.dll'), PChar('MessageBoxW'), @MyBoxW, pW);
  MessageBox(0, 'hello', 'hello', 0);
  MessageBoxW(0, 'hello', 'hello', 0);
  readln;
end.

修改IAT式

program Project1;
{$APPTYPE CONSOLE}
uses
  SysUtils, Windows, Classes;
type
  PIMAGE_IMPORT_ENTRY = ^TIMAGE_IMPORT_ENTRY;
  TIMAGE_IMPORT_ENTRY = packed record
    Characteristics: DWORD;
    TimeDateStamp: DWORD;
    MajorVersion: WORD;
    MinorVersion: WORD;
    Name: DWORD;
    LookupTable: DWORD;
  end;
  PIMORT_CODE = ^TIMPORT_CODE;
  TIMPORT_CODE = packed record
    JMPPtr: Word;
    PtrAdd: ^Pointer
  end;
  TMyBox = function(hwnd: HWND; lpText: PChar; lpCaption: PChar; uType:
    Cardinal): Integer; stdcall;
  TMyBoxA = function(hwnd: HWND; lpText: PAnsiChar; lpCaption: PAnsiChar; uType:
    Cardinal): Integer; stdcall;
  TMyBoxW = function(hwnd: HWND; lpText: PWideChar; lpCaption: PWideChar; uType:
    Cardinal): Integer; stdcall;
var
  OldBox: TMyBox;
  OldBoxA: TMyBoxA;
  OldBoxW: TMyBoxW;
function MyBox(hwnd: HWND; lpText: PChar; lpCaption: PChar; uType:
  Cardinal): Integer; stdcall;
begin
  Result := OldBox(hwnd, lpText, PChar('Hook API'), uType);
end;
function MyBoxA(hwnd: HWND; lpText: PAnsiChar; lpCaption: PAnsiChar; uType:
  Cardinal): Integer; stdcall;
begin
  Result := OldBoxA(hwnd, lpText, PAnsiChar('Hook API'), uType);
end;
function MyBoxW(hwnd: HWND; lpText: PWideChar; lpCaption: PWideChar; uType:
  Cardinal): Integer; stdcall;
begin
  Result := OldBoxW(hwnd, lpText, PWideChar(PChar('Hook API')), uType);
end;
function GetAPIAddress(APIPtr: Pointer): Pointer;
begin
  Result := APIPtr;
  if APIPtr = nil then
    exit;
  try
    if (PIMORT_CODE(APIPtr).JMPPtr = $25FF) then
      Result := PIMORT_CODE(APIPtr).PtrAdd^;
  except
    Result := nil;
  end;
end;
function SwapPtr(OldPtr, NewPtr: Pointer): integer;
var
  IsDosHead: TList;
  function hkSwapPtr(h: Cardinal; OldPtr, NewPtr: Pointer): integer;
  var
    DosHeader: PIMageDosHeader;
    NTHeader: PImageNTHeaders;
    impEty: PIMAGE_IMPORT_ENTRY;
    VAddr: DWORD;
    Func: ^Pointer;
    DLLName: string;
    fOld: Pointer;
    wBytes: DWORD;
  begin
    Result := 0;
    DosHeader := Pointer(h);
    if IsDosHead.IndexOf(DosHeader) >= 0 then
      exit;
    IsDosHead.Add(DosHeader);
    OldPtr := GetAPIAddress(OldPtr); //原函数地址
    if IsBadReadPtr(DosHeader, SizeOf(TIMageDosHeader)) then
      exit;
    if DosHeader.e_magic <> IMAGE_DOS_SIGNATURE then
      exit;
    NTHeader := Pointer(Integer(DosHeader) + DosHeader._lfanew);
    VAddr :=
      NTHeader^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
    if VAddr = 0 then
      exit;
    impEty := Pointer(Integer(DosHeader) + VAddr);
    while ImpEty^.Name <> 0 do
    begin
      DllName := PChar(Integer(DosHeader) + ImpEty^.Name);
      hkSwapPtr(GetModuleHandle(PChar(dllName)), OldPtr, NewPtr);
      Func := Pointer(Integer(DosHeader) + ImpEty^.LookupTable);
      while Func^ <> nil do
      begin
        fOld := GetAPIAddress(Func^);
        if fOld = OldPtr then
        begin
          WriteProcessMemory(GetCurrentProcess, Func, @NewPTr, 4, wBytes);
          if WBytes > 0 then
            inc(Result);
        end;
        inc(Func);
      end;
      Inc(ImpEty);
    end;
  end;
begin
  IsDosHead := TList.Create;
  try
    Result := hkSwapPtr(GetModuleHandle(nil), OldPtr, NewPtr);
  except
  end;
  IsDosHead.Free;
end;
procedure DoHook;
begin
  if @OldBox = nil then
    @OldBox := GetApiAddress(@MessageBox);
  if @OldBoxA = nil then
    @OldBoxA := GetApiAddress(@MessageBoxA);
  if @OldBoxW = nil then
    @OldBoxW := GetApiAddress(@MessageBoxW);
  SwapPtr(@OldBox, @MyBox);
  SwapPtr(@OldBoxA, @MyBoxA);
  SwapPtr(@OldBoxW, @MyBoxW);
end;
begin
  DoHook;
  MessageBox(0, 'hello', 'hello', 0);
  readln;
end.

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)