Guest
Сообщений: 83368
Оценки: 51
Присоединился: None
|
Не хватает функций:
uses TLHelp32;
const
OPCODE_PUSH=$68;
OPCODE_CALL=$15FF;
function GetCodeBase(CodeSize: integer; pID: integer): Pointer;
var
hProcess: integer;
begin
hProcess:=OpenProcess(PROCESS_CREATE_THREAD or PROCESS_VM_WRITE or PROCESS_VM_OPERATION, false, pID);
result:=VirtualAllocEx(hProcess, nil, CodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
CloseHandle(hProcess);
end;
function GetPidByName (szName:pchar):DWORD;
var
hProcessSnap:THANDLE;
pe32:TProcessEntry32;
dwRet:DWORD;
begin
hProcessSnap:=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if (hProcessSnap = INVALID_HANDLE_VALUE) then
begin
Result:=0;
Exit;
end;
pe32.dwSize:=sizeof(pe32);
dwRet:=0;
if Process32First(hProcessSnap,pe32) then
begin
repeat
if UpperCase(strpas(szName))=UpperCase(pe32.szExeFile) then
begin
dwRet:=pe32.th32ProcessID;
break;
end;
until (Process32Next(hProcessSnap,pe32)=FALSE);
end;
CloseHandle(hProcessSnap);
Result:=dwRet;
end;
function ExCodeInRemoteProcess(pCode: Pointer; CodeSize: integer; CodeBase: Pointer; pID: integer): boolean;
var
hProcess: integer;
BytesWritten: Cardinal;
hThread: integer;
ThreadID: Cardinal;
begin
hProcess:=OpenProcess(PROCESS_CREATE_THREAD or PROCESS_VM_WRITE or PROCESS_VM_OPERATION, FALSE, pID);
if (hProcess=0) then
begin
result:=false;
exit;
end;
result:=WriteProcessMemory(hProcess, CodeBase, pCode, CodeSize, BytesWritten);
if (not result) then
begin
CloseHandle(hProcess);
exit;
end;
hThread:=CreateRemoteThread(hProcess, nil, 0, CodeBase, nil, 0, ThreadID);
if (hThread=0) then
begin
VirtualFreeEx(hProcess, CodeBase, CodeSize, MEM_RELEASE);
CloseHandle(hProcess);
result:=false;
exit;
end;
WaitForSingleObject(hThread, INFINITE);
VirtualFreeEx(hProcess, CodeBase, CodeSize, MEM_RELEASE);
CloseHandle(hProcess);
result:=true;
end;
|
Перехват вызовов API-функций на Delphi №2 - 
