挂钩Windows API

挂钩Windows API(51) dd -1                   ; FF

                        end


    现在我们可以获取任意地址的指令长度。我们重复调用这个函数直到读取了5个字节。完成后把这些字节拷贝到old_hook。我们知道了开始这些指令的长度，所以我们可以在原始函数的下条指令填入跳转地址。

.386p
.model flat, stdcall

...

.data

kernel_name         db "kernel32.dll",0
sleep_name        db "Sleep",0

...

MEM_RELEASE        dd 000008000h

;16 nops + 一个跳转指令
old_sleep        db 090h,090h,090h,090h,090h,090h,090h,090h,
               090h,090h,090h,090h,090h,090h,090h,090h,
               0E9h,000h,000h,000h,000h


.code
start:
    push    5000
    call    Sleep

do_hook:
    push    offset kernel_name
    call    GetModuleHandleA
    push    offset sleep_name
        push    eax
    call    GetProcAddress
        push    eax
    mov    esi,eax

    xor    ecx,ecx
    mov    ebx,esi
get_five_bytes:
    push    ecx
    push    ebx