改IAT的apihook,
第一次用汇编..感觉就像写着批处理另外还要想象内存中代码指令的样子..好纠结啊
.386
.model flat, stdcall
option casemap: none
include windows.inc
include user32.inc
includelib user32.lib
include kernel32.inc
includelib kernel32.lib
IAT_OPCODE_LEN equ 6
;JMPOPCODE struct
;JMPOPCODE ends
.data
szCaption db 'Hello',0
szText db 'Hello World!',0
szNewText db 'Bye world!',0
.code
_HookFunc proc
;_HookFunc::
mov [esp+8],offset szNewText
_OrgJmp::
db 90h,90h,90h,90h,90h,90h
_HookFunc endp
_WriteMem proc _lpAddr,_dwSize,_lpbData ;lpAddr 叫 pvoidAddr比较好
local @flOrgProtect
local @flMyProtect
invoke VirtualProtect,_lpAddr,_dwSize,PAGE_EXECUTE_READWRITE,addr @flOrgProtect
invoke RtlMoveMemory,_lpAddr,_lpbData,_dwSize
;mov ecx,_dwSize ;counter
;mov esi,_lpbData ;pBuffer
;mov edi,_lpAddr ;pWriter
;rep movs byte ptr es:[edi],byte ptr ds:[esi]
invoke VirtualProtect,_lpAddr,_dwSize