Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #include "user32.h"
- #include "apihook.h"
- #include "Debug.h"
- // Generated by ExtractDef by Havenard <havenard@hotmail.com>
- HINSTANCE hOriginal = NULL;
- #define NONHOOKEDPROC(x) FARPROC o_##x;
- #include "user32.dsm"
- #define NONHOOKEDPROC(x) __declspec(naked) void __stdcall fo_##x(void) { __asm jmp o_##x }
- #include "user32.dsm"
- typedef HMODULE (WINAPI *t_LoadLibraryA)(LPCTSTR dllName);
- typedef HMODULE (WINAPI *t_LoadLibraryW)(LPCTSTR dllName);
- typedef HMODULE (WINAPI *t_LoadLibrary)(LPCTSTR dllName);
- t_LoadLibraryA OriginalLoadLibraryA = NULL;
- t_LoadLibraryW OriginalLoadLibraryW = NULL;
- t_LoadLibrary OriginalLoadLibrary = NULL;
- HMODULE WINAPI MyLoadLibraryA(LPCTSTR dllName) {
- HMODULE hResult = OriginalLoadLibraryA(dllName);
- Echo("pegou");
- return hResult;
- }
- HMODULE WINAPI MyLoadLibraryW(LPCTSTR dllName) {
- HMODULE hResult = OriginalLoadLibraryW(dllName);
- Echo("pegou w");
- return hResult;
- }
- HMODULE WINAPI MyLoadLibrary(LPCTSTR dllName) {
- HMODULE hResult = OriginalLoadLibrary(dllName);
- Echo("pegou wwww");
- return hResult;
- }
- const char kernel32_dll[] = "kernel32.dll";
- void InstallProcs() {
- char buffer[512];
- if (hOriginal) return;
- GetSystemDirectory(buffer, 512);
- strcat(buffer, "\\USER32.dll");
- hOriginal = LoadLibrary(buffer);
- #define NONHOOKEDPROC(x) o_##x = GetProcAddress(hOriginal, #x);
- #include "user32.dsm"
- OriginalLoadLibraryA = (t_LoadLibraryA)InstallApiHook(kernel32_dll, "LoadLibraryA", (PDWORD)MyLoadLibraryA);
- OriginalLoadLibraryW = (t_LoadLibraryW)InstallApiHook(kernel32_dll, "LoadLibraryW", (PDWORD)MyLoadLibraryW);
- OriginalLoadLibrary = (t_LoadLibrary)InstallApiHook(kernel32_dll, "LoadLibrary", (PDWORD)MyLoadLibrary);
- Echo("LoadLibraryA = 0x%p", OriginalLoadLibraryA);
- Echo("LoadLibraryW = 0x%p", OriginalLoadLibraryW);
- Echo("LoadLibrary = 0x%p", OriginalLoadLibrary);
- }
- BOOL APIENTRY DllMain(HINSTANCE hInstance, DWORD fdwReason, PVOID pvReserved) {
- switch (fdwReason) {
- case DLL_PROCESS_ATTACH:
- InstallProcs();
- break;
- case DLL_PROCESS_DETACH:
- FreeLibrary(hOriginal);
- break;
- }
- return TRUE;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement