| 发表于：2008-01-14 21:01:40 楼主 |
为什么一直出错呀
unit apihook ;
interface
uses
sysutils, windows, winsock, dialogs;
type
{ 要hook的api函数定义 }
twidetomulti = function （cp:cardinal; deflags:cardinal; lpwidechar:pwidechar;
cchwidechar:integer; lpmultibytestr:pansichar; cchmultibyte:integer;
lpdefaultchar:pansichar; lpuseddefaultchar:pbool): integer; stdcall;
procedure hookapi;
procedure unhookapi;
var
processhandle: hwnd;
baseaddress: array [0..2] of pointer;
oldproc: array [0..2] of array [0..7] of byte;
newporc: array [0..2] of array [0..7] of byte;
implementation
function mywidetomulti（cp:cardinal; deflags:cardinal; lpwidechar:pwidechar;
cchwidechar:integer; lpmultibytestr:pansichar; cchmultibyte:integer;
lpdefaultchar:pansichar; lpuseddefaultchar:pbool): integer; stdcall;
var
nsize: cardinal;
begin
showmessage（'已经调用自己'); 可以弹出这句,可是接下来就出错了
//showmessage（string（lpwidechar));
writeprocessmemory（processhandle, baseaddress[0], @oldproc[0], 8, nsize);
result := widechartomultibyte（cp, deflags, lpwidechar,
cchwidechar, lpmultibytestr, cchmultibyte,
lpdefaultchar, lpuseddefaultchar) ;
writeprocessmemory（processhandle, baseaddress[0], @newporc[0], 8, nsize);//在程序正常打開後再修改成自定義函數的地址,使所有程序在下次打開時都要先調用自定義函數
// unhookapi;
end;
procedure hookapi;
var
dllmodule: thandle;
nsize: cardinal;
dat: dword;
tmp : array [0..3] of byte;
begin
processhandle := dword（-1);
dllmodule := loadlibrary（'kernel32.dll');
{ 系统函数入口点地址 }
baseaddress[0] := getprocaddress（dllmodule,'widechartomultibyte');
dat := dword（@mywidetomulti);
move（dat, tmp, 4);
newporc[0][0] := $b8; { 汇编跳转指令 }
newporc[0][1] := tmp[0]; { 跳转到自身的函数 }
newporc[0][2] := tmp[1];
newporc[0][3] := tmp[2];
newporc[0][4] := tmp[3];
newporc[0][5] := $ff;
newporc[0][6] := $e0;
newporc[0][7] := 0;
{ 读取系统函数内存地址 }
readprocessmemory（processhandle, baseaddress[0], @oldproc[0], 8, nsize);
{ 用自己的函数地址覆盖系统的函数地址 }
writeprocessmemory（processhandle, baseaddress[0], @newporc[0], 8, nsize);
closehandle（processhandle);
end;
procedure unhookapi;
var
nsize: cardinal;
begin
{ 恢复所修改的地址 }
writeprocessmemory（processhandle, baseaddress[0], @oldproc[0], 8, nsize);
end;
end. |
|
|
|
|
