.586 .model flat, stdcall option casemap:none
include windows.inc include user32.inc include kernel32.inc include gdi32.inc include comdlg32.inc include ws2_32.inc include dbghelp.inc include shell32.inc include masm32.inc include advapi32.inc
includelib kernel32.lib includelib gdi32.lib includelib comdlg32.lib includelib user32.lib includelib ws2_32.lib includelib shell32.lib includelib masm32.lib includelib advapi32.lib includelib dbghelp.lib
public C Detoured_MessageBoxA public C Detoured_GetModuleHandleA public C Detoured_CreateFileA hookmain proto CTEXT macro Text:VARARG local szText .data szText byte Text, 0 .code exitm <offset szText> endm
.data hookmain Proc mov esi, offset hDlg mov edi, offset IDitem ret hDlg dd 0 IDitem dd 0 lbStr dd 10h dup (?) hookmain Endp lpbuffer byte 256 dup(0), 0
.data? Detoured_MessageBoxA dd ? Detoured_GetModuleHandleA dd ? Detoured_ExitProcess dd ? Detoured_CreateFileA dd ?
.code
DllEntry proc hInstance:HINSTANCE, reason:DWORD, reserved1:DWORD .if reason==DLL_PROCESS_ATTACH mov eax,TRUE .endif ret DllEntry Endp
HOOK_user32_MessageBoxA proc hwnd:DWORD, text:DWORD, about:DWORD, icon:DWORD
push icon push CTEXT("提示") push CTEXT("MessageBoxA内容被HOOK了") push hwnd call Detoured_MessageBoxA pushad invoke SendDlgItemMessage,hDlg,IDitem,EM_SETSEL,-1,-1 invoke SendDlgItemMessage,hDlg,IDitem,EM_REPLACESEL,FALSE,CTEXT("MessageBoxA内容被HOOK了",13,10,0) popad ret
HOOK_user32_MessageBoxA endp HOOK_kernel32_CreateFileA proc lpFileName:DWORD,dwAccess:DWORD,dwMode:DWORD,lpAttr:DWORD,dwPostion:DWORD,dwFlag:DWORD,hTempFile:DWORD LOCAL temp[200]:byte pushad invoke GetModuleFileName,NULL, addr temp, sizeof temp invoke lstrcpyA,addr temp,CTEXT("CreateFileA-lpFileName:",) invoke lstrcatA,addr temp,lpFileName invoke SendDlgItemMessage,hDlg,IDitem,EM_SETSEL,-1,-1 invoke SendDlgItemMessage,hDlg,IDitem,EM_REPLACESEL,FALSE,addr temp popad ret HOOK_kernel32_CreateFileA endp HOOK_kernel32_GetModuleHandleA proc modulename:dword ret HOOK_kernel32_GetModuleHandleA endp
HOOK_kernel32_ExitProcess proc exitcode:dword invoke TerminateProcess, -1, exitcode ret HOOK_kernel32_ExitProcess endp
End DllEntry
|