Question

我想知道如何绕道一个函数，例如WriteProcessMemory？

作为WriteProcessMemory Monitor：

http://www.novirusthanks.org

Answer 1

您需要创建D-Tour

你需要这样的记录：

unit PatchU;

interface

type
  TPatchMethod = record
  private type
    pPatchEvent = ^TPatchEvent;

    // "Asm" opcode hack to patch an existing routine
    TPatchEvent = packed record
      Jump: Byte;
      Offset: Integer;
    end;

  var
    PatchedMethod, OriginalMethod: TPatchEvent;
    PatchPositionMethod: pPatchEvent;
  public
    constructor Create(const aSource, aDestination: Pointer);
    procedure Restore;
    procedure Hook;
  end;

implementation

uses
  Windows, Sysutils;

{ TPatchMethod }

constructor TPatchMethod.Create(const aSource, aDestination: Pointer);
var
  OldProtect: Cardinal;
begin
  PatchPositionMethod := pPatchEvent(aSource);
  OriginalMethod := PatchPositionMethod^;
  PatchedMethod.Jump := $E9;
  PatchedMethod.Offset := PByte(aDestination) - PByte(PatchPositionMethod) - SizeOf(TPatchEvent);

  if not VirtualProtect(PatchPositionMethod, SizeOf(TPatchEvent), PAGE_EXECUTE_READWRITE, OldProtect) then
    RaiseLastOSError;

  Hook;
end;


procedure TPatchMethod.Hook;
begin
  PatchPositionMethod^ := PatchedMethod;
end;

procedure TPatchMethod.Restore;
begin
  PatchPositionMethod^ := OriginalMethod;
end;

end.

然后使用它：

var
  TcxLabel_Patch: TPatchMethod;

...

type
  THooked_cxLabel = class(TcxLabel)
    constructor HookedCreate(AOwner: TComponent);
  end;

...

  THooked_cxImage = class(TcxImage)
    constructor HookedCreate(AOwner: TComponent);
  end;

constructor THooked_cxLabel.HookedCreate(AOwner: TComponent);
begin
  TcxLabel_Patch.Restore;
  try
    Create(AOwner);
    Transparent := True;
  finally
    TcxLabel_Patch.Hook;
  end;
end;

...

initialization
  TcxLabel_Patch := TPatchMethod.Create(@TcxLabel.Create, @THooked_cxLabel.HookedCreate);
finalization
end.

在这个例子中，我挂钩了一个tcxalbel的构造函数。但你可以挂钩一切。

WriteProcessMemory函数中的Global Hook

1 个答案: