delphi编写的外挂型DLL有问题,求助!

johnroot

下面是需要破解的程序,它每次调用LPK.dll
我就写个DLL来做内存补丁.

原理:把自己写的DLL放程序目录,程序就会先调用它,有人用C语言写成功过.

crackme.rar (3.42 KB, 下载次数: 12)

2007-8-20 10:01 上传

点击文件名下载附件

lpk.rar (1.46 KB, 下载次数: 12)

2007-8-20 12:16 上传

点击文件名下载附件

我写了个DLL用来动态修改内存的，模拟WINDOWS的LPK.dll
但静态调用时出错！谁帮我看下！

1. 
   
2. library lpk;
   
3. 
   
4. { Important note about DLL memory management: ShareMem must be the
   
5.   first unit in your library's USES clause AND your project's (select
   
6.   Project-View Source) USES clause if your DLL exports any procedures or
   
7.   functions that pass strings as parameters or function results. This
   
8.   applies to all strings passed to and from your DLL--even those that
   
9.   are nested in records and classes. ShareMem is the interface unit to
   
10.   the BORLNDMM.DLL shared memory manager, which must be deployed along
    
11.   with your DLL. To avoid using BORLNDMM.DLL, pass string information
    
12.   using PChar or ShortString parameters. }
    
13. 
    
14. 
    
15. uses
    
16.   SysUtils,
    
17.   windows,
    
18.   Classes;
    
19. 
    
20. 
    
21. var
    
22.   wj1,wj2,wj3,wj4,wj5,wj6,wj7,wj8,wj9,wj10,wj11:pointer;
    
23. {$R *.res}
    
24. procedure DLLEntry(reason: DWORD);　//dll装载时执行
    
25. var
    
26.   ljj:PChar;
    
27.   ljj2:string;
    
28.   DLLHandle: THandle;
    
29.   pData:pointer;
    
30.   mbi_thunk: TMemoryBasicInformation;
    
31. begin
    
32.   case reason of
    
33.     DLL_PROCESS_ATTACH:
    
34.     begin
    
35.     ljj:=AllocMem(512);
    
36.     GetSystemDirectory(ljj,256);              //获取系统目录
    
37.     ljj2:=string(ljj)+'\lpk.dll' ;　　　　　　//连接＂\lpk.dll"
    
38.     ljj:=nil;
    
39.     FreeMem(ljj);
    
40.     DLLHandle := LoadLibrary(PChar(ljj2));
    
41. //下面是获取LPK.DLL的输出函数
    
42.     wj1:=GetProcAddress(DLLHandle, 'ftsWordBreak');
    
43.     wj2:=GetProcAddress(DLLHandle, 'LpkUseGDIWidthCache');
    
44.     wj3:=GetProcAddress(DLLHandle, 'LpkPSMTextOut');
    
45.     wj4:=GetProcAddress(DLLHandle, 'LpkGetTextExtentExPoint');
    
46.     wj5:=GetProcAddress(DLLHandle, 'LpkGetCharacterPlacement');
    
47.     wj6:=GetProcAddress(DLLHandle, 'LpkExtTextOut');
    
48.     wj7:=GetProcAddress(DLLHandle, 'LpkEditControl');
    
49.     wj8:=GetProcAddress(DLLHandle, 'LpkDrawTextEx');
    
50.     wj9:=GetProcAddress(DLLHandle, 'LpkDllInitialize');
    
51.     wj10:=GetProcAddress(DLLHandle, 'LpkTabbedTextOut');
    
52.     wj11:=GetProcAddress(DLLHandle, 'LpkInitialize');
    
53.    //下面是修改内存程序段 ,(这段去掉也不能加载,不是下面这段的问题)
    
54.     pData := pointer($00403296);
    
55.    //查询页信息。
    
56.    VirtualQuery(pData, mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));
    
57.    / /改变页保护属性为读写。
    
58.     asm
    
59.     push eax
    
60.     push edx
    
61.     mov eax,$4024E0
    
62.     cmp [eax],$358b6674
    
63.     jne @@11
    
64.     mov edx,$358b9090
    
65.     mov [eax],edx
    
66.     @@11:
    
67.     pop edx
    
68.     pop eax
    
69.     end;
    
70. 
    
71.     end;
    
72.     DLL_PROCESS_DETACH:
    
73.     begin
    
74. 
    
75.     end;
    
76.   end;
    
77. end;
    
78. 
    
79. 
    
80. 
    
81. 
    
82. procedure ftsWordBreak;stdcall;　//模拟windows的lpk.dll的函数
    
83. begin
    
84. asm
    
85. jmp wj1
    
86. end;
    
87. end;
    
88. 
    
89. procedure LpkUseGDIWidthCache;stdcall;　//模拟windows的lpk.dll的函数
    
90. begin
    
91. asm
    
92. jmp wj2
    
93. end;
    
94. end;
    
95. 
    
96. procedure LpkPSMTextOut;stdcall;　//模拟windows的lpk.dll的函数
    
97. begin
    
98. asm
    
99. jmp wj3
    
100. end;
     
101. end;
     
102. 
     
103. procedure LpkGetTextExtentExPoint;stdcall;　//模拟windows的lpk.dll的函数
     
104. begin
     
105. asm
     
106. jmp wj4
     
107. end;
     
108. end;
     
109. 
     
110. procedure LpkGetCharacterPlacement;stdcall;　//模拟windows的lpk.dll的函数
     
111. begin
     
112. asm
     
113. jmp wj5
     
114. end;
     
115. end;
     
116. 
     
117. procedure LpkExtTextOut;stdcall;　//模拟windows的lpk.dll的函数
     
118. begin
     
119. asm
     
120. jmp wj6
     
121. end;
     
122. end;
     
123. 
     
124. 
     
125. procedure LpkEditControl;stdcall;　//模拟windows的lpk.dll的函数
     
126. begin
     
127. asm
     
128. jmp wj7
     
129. end;
     
130. end;
     
131. 
     
132. 
     
133. procedure LpkDrawTextEx;stdcall;　//模拟windows的lpk.dll的函数
     
134. begin
     
135. asm
     
136. jmp wj8
     
137. end;
     
138. end;
     
139. 
     
140. procedure LpkDllInitialize;stdcall;　//模拟windows的lpk.dll的函数
     
141. begin
     
142. asm
     
143. jmp wj9
     
144. end;
     
145. end;
     
146. 
     
147. procedure LpkTabbedTextOut;stdcall;　//模拟windows的lpk.dll的函数
     
148. begin
     
149. asm
     
150. jmp wj10
     
151. end;
     
152. end;
     
153. 
     
154. procedure LpkInitialize;stdcall; 　//模拟windows的lpk.dll的函数
     
155. begin
     
156. asm
     
157. jmp wj11
     
158. end;
     
159. end;
     
160. 
     
161. 
     
162. exports
     
163.   ftsWordBreak Index 11,
     
164.   LpkUseGDIWidthCache Index 10,
     
165.   LpkPSMTextOut Index 9,
     
166.   LpkGetTextExtentExPoint Index 8,
     
167.   LpkGetCharacterPlacement Index 7,
     
168.   LpkExtTextOut Index 6,
     
169.   LpkEditControl Index 5,
     
170.   LpkDrawTextEx Index 4,
     
171.   LpkDllInitialize Index 3,
     
172.   LpkTabbedTextOut Index 2,
     
173.   LpkInitialize Index 1;
     
174. 
     
175. begin
     
176.   DLLProc := @DLLEntry;
     
177.   DLLEntry(DLL_PROCESS_ATTACH);
     
178. end.
     

复制代码

先谢谢了!

[ 本帖最后由 johnroot 于 2007-8-20 12:16 编辑 ]

黑夜彩虹

标记，回头学习。。。。/:good

Gue

1. 
   
2.     wj1:=GetProcAddress(DLLHandle, 'ftsWordBreak');
   
3.     wj2:=GetProcAddress(DLLHandle, 'LpkUseGDIWidthCache');
   
4.     wj3:=GetProcAddress(DLLHandle, 'LpkPSMTextOut');
   
5.     wj4:=GetProcAddress(DLLHandle, 'LpkGetTextExtentExPoint');
   
6.     wj5:=GetProcAddress(DLLHandle, 'LpkGetCharacterPlacement');
   
7.     wj6:=GetProcAddress(DLLHandle, 'LpkExtTextOut');
   
8.     wj7:=GetProcAddress(DLLHandle, 'LpkEditControl');
   
9.     wj8:=GetProcAddress(DLLHandle, 'LpkDrawTextEx');
   
10.     wj9:=GetProcAddress(DLLHandle, 'LpkDllInitialize');
    
11.     wj10:=GetProcAddress(DLLHandle, 'LpkTabbedTextOut');
    
12.     wj11:=GetProcAddress(DLLHandle, 'LpkInitialize');
    

复制代码

这种调用应该要有函数原型的吧.Delphi应该也有函数指针的.

1. 
   
2. procedure LpkExtTextOut;stdcall;　//模拟windows的lpk.dll的函数
   
3. begin
   
4. asm
   
5. jmp wj6
   
6. end;
   
7. end;
   

复制代码

   这种就跳到DLL执行,参数无法传递了..

[ 本帖最后由 Gue 于 2007-8-20 20:33 编辑 ]

caterpilla

有没有C语言版本的参考下？

Gue

我的机器有人在用着,这些是在记事本里写的,没有测试过...

以MessageBox为例, 在MSDN上查得原型如下:

1. 
   
2. int MessageBox(          HWND hWnd,
   
3.     LPCTSTR lpText,
   
4.     LPCTSTR lpCaption,
   
5.     UINT uType
   
6. );
   

复制代码

因此,我们定义函数原型

1. 
   
2. typedef int (WINAPI *MESSAGEBOX)(HWND, LPCTSTR, LPCTSTR, UINT);
   
3. 
   
4. //定义指向这一类函数的指针
   
5. 
   
6. MESSAGEBOX _MessageBox;
   
7. 
   
8. //加载User32.dll
   
9. HANDLE hUser32 = LoadLibrary("User32.dll");
   
10. 
    
11. if (hUser32) {
    
12.         //获取MessageBoxA的地址
    
13.         _MessageBox = (MESSAGEBOX)GetProcAddress(hUser32, "MessageBoxA");
    
14. }
    
15. 
    
16. 
    
17. int WINAPI MessageBoxA(HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption, UINT uType)
    
18. {
    
19.         //在这里做你想做的事
    
20.        
    
21.         return _MessageBox(hWnd, lpText, lpCaption, uType);
    
22. }
    
23. 
    
24. 
    
25. //卸载本DLL前卸载掉User32.dll
    

复制代码