|
挂钩Windows API(9) FlushInstructionCache PROTO :DWORD,:DWORD,:DWORD GetCurrentProcess PROTO ExitProcess PROTO :DWORD
.data
kernel_name db "kernel32.dll",0 sleep_name db "Sleep",0 old_protect dd ?
MEMORY_BASIC_INFORMATION_SIZE equ 28
PAGE_READWRITE dd 000000004h PAGE_EXECUTE_READWRITE dd 000000040h MEM_COMMIT dd 000001000h MEM_RELEASE dd 000008000h
.code start: push 5000 call Sleep
do_hook: push offset kernel_name call GetModuleHandleA push offset sleep_name push eax call GetProcAddress mov edi,eax ;最后获得Sleep地址
push PAGE_READWRITE push MEM_COMMIT push MEMORY_BASIC_INFORMATION_SIZE push 0 call VirtualAlloc test eax,eax jz do_sleep mov esi,eax ;为MBI结构分配内存
|