Question

VC API HOOK问题(JMP)

谢谢同志们,
这代码哪里有错呀!我搞了一晚上都没发现错,大家帮我看看,谢谢!

BYTE NewFunc[8];

HMODULE hUser32 = GetModuleHandle("user32.dll");
if (hUser32 == NULL)
{
hUser32 = LoadLibrary("user32.dll");
}
FARPROC hookfunc = GetProcAddress(hUser32,"MessageBoxA");
//char *buff={"aaa"};

NewFunc[0] = 0xe9;// JMP

PDWORD pNewFuncAddress;
pNewFuncAddress = (DWORD*)&NewFunc[1]; //指针

*pNewFuncAddress = (DWORD)&MessageBox2 - (DWORD)hookfunc - 5;

HANDLE hProcess = GetCurrentProcess();

DWORD dwOldFlag;
if(VirtualProtect(&hookfunc,5,PAGE_READWRITE,&dwOldFlag))
{
if(WriteProcessMemory(hProcess,&hookfunc,NewFunc,5,0))
{
VirtualProtect(NewFunc,5,dwOldFlag,&dwOldFlag);
//return;
MessageBoxA(NULL,"aaa","bbb",MB_OK);
}
}

这里是MessageBox2的函数

int MessageBox2(
HWND hWnd, // handle to owner window
LPCTSTR lpText, // text in message box
LPCTSTR lpCaption, // message box title
UINT uType // message box style
)
{
printf("aaa");
return 0;
}

Answer 1

新手么? 还是用MS的detours吧