【3.A.S.T】网络安全爱好者 » 原创专区 » 全局动态调用

ice_xke 发表于 2010-10-19 12:30

全局动态调用

全局动态调用笔记6Dp!WA]'aV*O
svchost files工程->插入->类(Generic Class DTDY)->DTDY.cpp DTDY.h
\Ff'B@+T;X ----------------------------------------;o0m9PP n0A+XdX
DTDY.h：
;z*a&z1CL+l3B S;v1D*h"b ^u
#if _MSC_VER>1000J"]4`${zto
{;R\"If
#pragma once
In\V/qxq3^`
@;c #endif //_MSC_VER>1000,SDnBKQO
#include<windows.h>
H,k gUVw7U
1l"Sv*D
_:I typedef DWORD (__stdcall *pGetModuleFileNameA)(HMODULE,LPSTR,DWORD);
9qh2mY6n
~R/e!r0j class DTDY&T(a2A a
ww bj2S
{9~$T}V2z%n:Y
public:
1J!On7JoR DTDY();Onp!~k]M
js
virtual ~DTDY();
jkc3v}t#sUKy public:Z!?Hn'`
static pGetModuleFileNameA MyGetModuleFileName;;{ J8MJ"w%\pP;At6v
static BOOL FunInitiallization();]^!A;`T;J
};
7A} P mff9U,` #endif[;eT~;L%YV[BG
----------------------------------------
?2PINY*C"oq
X'i F h:G5t6m DTDY.cpp:

@?^ `$apiZ uM?1dz
G)EL_r
#include "DTDY.h"
kU%DV3] pGetModuleFileNameA DTDY::MyGetModuleFileName=NULL;
q$`k'_&L DTDY:TDY()M%`3NFQ?r#N"E
{
%Ib[:JQ"^:A*Ql~#| }
k_(T]iOW DTDY::~DTDY()
0J0K;N%TwE1i'Dc {
4cu a'ix0tx6C }
$j7G;y8UJL+?1`M BOOL DTDY::FunInitiallization()1Ml5AeR@'R8R
{y%FST!k5y|
HMODULE hModule=LoadLibrary("kernel32.dll");!Yxqj^9x3B.ZN#U
MyGetModuleFileName=(pGetModuleFileNameA)GetProcAddress(hModule,"GetModuleFileNameA"); xV7JQM)e(jN)K
if(!MyGetModuleFileName=) return FALSE;
N%uA-{%s-f D]G/N1kl-jK
return TRUE;
5DfG,A(u;?4j0c }
9Y:A"zgo ----------------------------------------
5A
w z.G4M%Gu4uRn]hh svchost.cpp:
x/R e S5L2P.e0b%j4W
0ghi9w Z1zo #include "DTDY.h"
B d$nsy"F
$K6F|}}p BOOL APIENTRY DllMain(HANDLE hModule,DWORD ul_reason_for_call,LPVOID lpReserved)S9hJ\`L(\
{zKo*SF
switch(ul_reason_for_call)
.Gw]BRY8p3W%@7@ {5Kgi+l~![;ZH
case DLL_PROCESS_ATTACH:
.u?:j x1[0aJ6n if(!DTDY::FunInitiallization()) return FALSE;%ut[8u*C3R3b
lU]V#?
break;
^3Aqh%UO2` _E#X }6p5MExk2\
}7h![4Yl[-X jv2{:Vg

2f8nH&Psl(?$IH3Wr $tM.{K`8~lF8d
GetModuleFileName(CKeyboardManager::g_hInstance,strFileName,sizeof(strFileName));->goto def5t%] LkzE
改写为I~t+|Z,W,n-u
DTDY::MyGetModuleFileName(CKeyboardManager::g_hInstance,strFileName,sizeof(strFileName));H['lZ'EvO
----------------------------------------
GuAIoV KernelManager.cpp:
rL:BWwC9s$?6|sFN M&M)U[.Q(x S
#include "../DTDY.h"7i7J/{$S$v(X9Ubi
GetModuleFileName(CKeyboardManager::g_hInstance,strServiceDll,sizeof(strServiceDll));
8u5u$D7LT
S?sq 改写为
l w)F{~$J/{@mjy DTDY::MyGetModuleFileName(CKeyboardManager::g_hInstance,strServiceDll,sizeof(strServiceDll));(i$^.t$IisxbG
----------------------------------------

查看完整版本: 全局动态调用