asm的本地Apihook(IAT)

改IAT的apihook, 

第一次用汇编..感觉就像写着批处理另外还要想象内存中代码指令的样子..好纠结啊

		.386
		.model flat, stdcall
		option casemap: none
include 	windows.inc
include 	user32.inc
includelib 	user32.lib
include 	kernel32.inc
includelib 	kernel32.lib
IAT_OPCODE_LEN	equ 6
;JMPOPCODE		struct

;JMPOPCODE		ends
		.data
szCaption	db	'Hello',0
szText		db	'Hello World!',0
szNewText	db	'Bye world!',0

		.code
_HookFunc		proc
;_HookFunc::
		mov [esp+8],offset szNewText

_OrgJmp::
		db 90h,90h,90h,90h,90h,90h
_HookFunc		endp

_WriteMem		proc	_lpAddr,_dwSize,_lpbData ;lpAddr 叫 pvoidAddr比较好
		local @flOrgProtect
		local @flMyProtect
		invoke	VirtualProtect,_lpAddr,_dwSize,PAGE_EXECUTE_READWRITE,addr @flOrgProtect
		invoke	RtlMoveMemory,_lpAddr,_lpbData,_dwSize
		;mov ecx,_dwSize		;counter
		;mov esi,_lpbData	;pBuffer
		;mov edi,_lpAddr		;pWriter
		;rep movs byte ptr es:[edi],byte ptr ds:[esi]
		invoke	VirtualProtect,_lpAddr,_dwSize