DLL外挂型内存补丁的实现

johnroot

DLL外挂型内存补丁的实现：

思路：自己写个DLL文件PYG.DLL 输出函数K ,找个程序需要调用DLL文件(我用的LPK.DLL,基本上可执行程序都要用到).用PE工具填加
         输入表PYG.DLL  函数K,然后把PYG.DLL和LPK.DLL   COPY到要破解的程序目录.这样程序调用LPK.DLL 就会加载PYG.DLL来执行
         修改内存的目的.

例子: 例子.rar (25.74 KB, 下载次数: 264)

2007-8-21 15:41 上传

点击文件名下载附件

DLL部分:

1. 
   
2. library pyg;
   
3. 
   
4. { Important note about DLL memory management: ShareMem must be the
   
5.   first unit in your library's USES clause AND your project's (select
   
6.   Project-View Source) USES clause if your DLL exports any procedures or
   
7.   functions that pass strings as parameters or function results. This
   
8.   applies to all strings passed to and from your DLL--even those that
   
9.   are nested in records and classes. ShareMem is the interface unit to
   
10.   the BORLNDMM.DLL shared memory manager, which must be deployed along
    
11.   with your DLL. To avoid using BORLNDMM.DLL, pass string information
    
12.   using PChar or ShortString parameters. }
    
13. 
    
14. uses
    
15.   windows,
    
16.   TlHelp32,
    
17.   Unit1 in 'Unit1.pas';
    
18. 
    
19. var
    
20. Pn: TProcesseNtry32;
    
21. 
    
22. {$R *.res}
    
23. procedure k;stdcall;
    
24. begin
    
25. end;
    
26. 
    
27. 
    
28. 
    
29. procedure MyDLLProc;stdcall;
    
30. var
    
31. hHandle:HWND;
    
32. begin
    
33. hHandle:=pn.th32ParentProcessID;
    
34. //HookOn(hHandle,0);
    
35. HookOn(hHandle,WH_shell); //安装钩子
    
36. end;
    
37. exports
    
38.   k;
    
39. 
    
40. begin
    
41. DLLProc:=@MyDLLProc;
    
42. MyDLLProc;
    
43. end.
    

复制代码

修改内存模块:

1. 
   
2. unit Unit1;
   
3. 
   
4. interface
   
5. uses
   
6. windows;
   
7. 
   
8. 
   
9. 
   
10. var
    
11. hHk: HHOOK=0;
    
12. mhwnd:HWND=0;
    
13. hThread: Cardinal;
    
14. hmod: Pointer; //Hinstance
    
15. 
    
16. 
    
17. procedure HookProc;stdcall;
    
18. function HookOn(lpHwnd:HWND;lpType:Longint): Longint;stdcall;
    
19. function HookOff:Boolean;stdcall;
    
20. 
    
21. implementation
    
22. 
    
23. function HookOn(lpHwnd:HWND;lpType:Longint): Longint;stdcall; export;
    
24. begin
    
25. mhwnd:=lpHwnd;
    
26. if hHk<>0 then UnHookWindowsHookEx(hHk);
    
27. hThread :=GetWindowThreadProcessId(mhwnd,hmod);
    
28. hHk :=SetWindowsHookEx(lpType,@HookProc,hInstance,hThread); // WH_KEYBOARD
    
29. Result :=hHk;
    
30. end;
    
31. 
    
32. procedure ModMemData();
    
33. var
    
34.   pData: pointer;
    
35.   dwOldProtect:DWORD;
    
36.   mbi_thunk: TMemoryBasicInformation;
    
37. 
    
38. begin
    
39. 
    
40.   pData := pointer($004024e0);
    
41.   //查询页信息。
    
42.   VirtualQuery(pData, mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));
    
43.   //改变页保护属性为读写。
    
44.   VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize,PAGE_READWRITE, mbi_thunk.Protect);
    
45. 
    
46. end;
    
47. 
    
48. 
    
49. procedure HookProc;stdcall;
    
50. var
    
51.   ljj:pchar;
    
52.   ljj2:string;
    
53.   DLLHandle: THandle;
    
54. begin
    
55. 
    
56. try
    
57. begin
    
58.     asm
    
59.     pushad
    
60.     pushfd
    
61.     mov eax,$004024e0
    
62.     mov edx,$358b6674
    
63.     cmp [eax],edx
    
64.     jne @@11
    
65.     push eax
    
66.     call ModMemData;
    
67.     pop eax
    
68.     mov edx,$358b9090
    
69.     mov [eax],edx
    
70.     @@11:
    
71.     popfd
    
72.     popad
    
73.     end;
    
74. end;
    
75. except
    
76. begin
    
77.      asm
    
78.      popfd
    
79.      popad
    
80.      end;
    
81. end;
    
82. end;
    
83. HookOff;     //卸载钩子
    
84. end;
    
85. 
    
86. 
    
87. function HookOff:Boolean;stdcall;
    
88. begin
    
89. if hHk<>0 then
    
90. begin
    
91. UnHookWindowsHookEx(hHk);
    
92. hHk :=0;
    
93. Result :=true;
    
94. end
    
95. else
    
96. Result :=false;
    
97. end;
    
98. 
    
99. 
    
100. 
     
101. 
     
102. end.
     

复制代码

caterpilla

学习，修改DLL导入表，导入新DLL，这个想法/:good 。。。。。
004024e0是要修改软件的指令地址吗？358b6674是指令二进制代码吧。

160904033

不错的例子.收藏了 感谢~/:001

small-q

学习:loveliness: 超强

棒棒糖

/:L

这个真的是强悍

太星

很好的例程阿！学习

iq2000

顶起   /:014 /:014 /:014

aytcgjb

这个东西不错，可以躲过内存校验

xingke

感谢楼主分享，不错的代码

黑色冰雨

谢谢楼主,非常好的东西