Chinaunix首页 | 论坛 | 博客
  • 博客访问: 1049090
  • 博文数量: 50
  • 博客积分: 10000
  • 博客等级: 上将
  • 技术积分: 2037
  • 用 户 组: 普通用户
  • 注册时间: 2007-04-05 08:03
文章分类
文章存档

2011年(1)

2010年(3)

2009年(17)

2008年(29)

我的朋友

分类: WINDOWS

2009-05-25 16:29:36

 

.586
.model flat, stdcall
option casemap:none

include windows.inc
include user32.inc
include kernel32.inc
include gdi32.inc
include comdlg32.inc
include ws2_32.inc
include dbghelp.inc
include shell32.inc
include masm32.inc
include advapi32.inc

includelib kernel32.lib
includelib gdi32.lib
includelib comdlg32.lib
includelib user32.lib
includelib ws2_32.lib
includelib shell32.lib
includelib masm32.lib
includelib advapi32.lib
includelib dbghelp.lib


public C Detoured_MessageBoxA
public C Detoured_GetModuleHandleA
public C Detoured_CreateFileA
hookmain proto
CTEXT macro Text:VARARG
    local szText
    .data
     szText byte Text, 0
    .code
        exitm <offset szText>
endm

.data
hookmain Proc
           mov esi, offset hDlg
           mov edi, offset IDitem
           ret
           hDlg dd 0
           IDitem dd 0
           lbStr dd 10h dup (?)
hookmain Endp
lpbuffer byte 256 dup(0), 0


.data?
Detoured_MessageBoxA dd ?
Detoured_GetModuleHandleA dd ?
Detoured_ExitProcess dd ?
Detoured_CreateFileA dd ?

.code

DllEntry proc hInstance:HINSTANCE, reason:DWORD, reserved1:DWORD
  .if reason==DLL_PROCESS_ATTACH
            mov eax,TRUE
  .endif
  ret
DllEntry Endp

HOOK_user32_MessageBoxA proc hwnd:DWORD, text:DWORD, about:DWORD, icon:DWORD

                        push icon
                        push CTEXT("提示")
                        push CTEXT("MessageBoxA内容被HOOK了")
                        push hwnd
                        call Detoured_MessageBoxA
                        pushad
                        invoke SendDlgItemMessage,hDlg,IDitem,EM_SETSEL,-1,-1
     invoke SendDlgItemMessage,hDlg,IDitem,EM_REPLACESEL,FALSE,CTEXT("MessageBoxA内容被HOOK了",13,10,0)
     popad
                        ret

HOOK_user32_MessageBoxA endp
HOOK_kernel32_CreateFileA proc lpFileName:DWORD,dwAccess:DWORD,dwMode:DWORD,lpAttr:DWORD,dwPostion:DWORD,dwFlag:DWORD,hTempFile:DWORD
LOCAL temp[200]:byte
                        pushad
                        invoke GetModuleFileName,NULL, addr temp, sizeof temp
                        invoke lstrcpyA,addr temp,CTEXT("CreateFileA-lpFileName:",)
                        invoke lstrcatA,addr temp,lpFileName
     invoke SendDlgItemMessage,hDlg,IDitem,EM_SETSEL,-1,-1
     invoke SendDlgItemMessage,hDlg,IDitem,EM_REPLACESEL,FALSE,addr temp
    
     popad
                        ret
HOOK_kernel32_CreateFileA endp
HOOK_kernel32_GetModuleHandleA proc modulename:dword
                        
                        ret
                        
HOOK_kernel32_GetModuleHandleA endp

HOOK_kernel32_ExitProcess proc exitcode:dword
                        
                        invoke TerminateProcess, -1, exitcode
                        ret
                        
HOOK_kernel32_ExitProcess endp



End DllEntry

阅读(3026) | 评论(0) | 转发(0) |
给主人留下些什么吧!~~