Click here to Skip to main content
16,011,374 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
GeneralRe: Maximaze window ??? Pin
jmkhael7-Jul-04 7:08
jmkhael7-Jul-04 7:08 
Generaluser mapping of shortcut keys Pin
John R. Shaw7-Jul-04 6:38
John R. Shaw7-Jul-04 6:38 
GeneralRe: user mapping of shortcut keys Pin
DavidR_r7-Jul-04 8:49
DavidR_r7-Jul-04 8:49 
GeneralRe: user mapping of shortcut keys Pin
John R. Shaw7-Jul-04 9:47
John R. Shaw7-Jul-04 9:47 
GeneralChging default printers Pin
Jim Barrett7-Jul-04 6:28
Jim Barrett7-Jul-04 6:28 
Generalsubclassing in win32 Pin
Manu817-Jul-04 6:14
Manu817-Jul-04 6:14 
GeneralRe: subclassing in win32 Pin
Antti Keskinen7-Jul-04 10:54
Antti Keskinen7-Jul-04 10:54 
GeneralHooK API Problem Pin
cyberkit7-Jul-04 5:19
cyberkit7-Jul-04 5:19 
There's some problems in Hooking api.I inject my dll into the hooked process.The hooked api is gethostbyname.
I want to use MY_gethostbyname to replace the gethostbyname.While the My_gethostbyname was running,the wrong message appeared."Access violation at address 0102104D.Write of address 00000000." MY_gethostbyname's return value must wrong!I don't know how to write the funtion MY_gethostbyname.Who can help me? Thanks.


// hook.cpp : Defines the entry point for the DLL application.
//

#include "stdafx.h"

#include <winsock2.h>
#include <windows.h>
#include <imagehlp.h>
#pragma comment(lib, "ImageHlp")
#pragma comment(lib,"Ws2_32")
extern "C" __declspec(dllexport) struct hostent* FAR MY_gethostbyname(const char* name
);

static void WINAPI ReplaceIATEntryInOneMod(PCSTR pszCalleeModName,
PROC pfnOrig, PROC pfnHook, HMODULE hmodCaller);
void process();

hostent *phostent=new hostent;

BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
process();
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}

struct hostent* FAR MY_gethostbyname(const char* name)
{

//hostent *phostent=malloc(sizeof(hostent));
//MessageBox(NULL,"I'm in MY_gethostbyname",NULL,NULL);

unsigned int *ip[2]={0};
*ip[0]=3232235521;
*ip[1]=NULL;
phostent->h_addr_list =(char**)ip;
phostent->h_length =4;
return phostent;


}


static void WINAPI ReplaceIATEntryInOneMod(PCSTR pszCalleeModName,
PROC pfnCurrent, PROC pfnNew, HMODULE hmodCaller) {

// Get the address of the module's import section
ULONG ulSize;
PIMAGE_IMPORT_DESCRIPTOR pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)
ImageDirectoryEntryToData(hmodCaller, TRUE,
IMAGE_DIRECTORY_ENTRY_IMPORT, &ulSize);

if (pImportDesc == NULL)
return; // This module has no import section

// Find the import descriptor containing references to callee's functions
for (; pImportDesc->Name; pImportDesc++) {
PSTR pszModName = (PSTR) ((PBYTE) hmodCaller + pImportDesc->Name);
if (lstrcmpiA(pszModName, pszCalleeModName) == 0)
break; // Found
}

if (pImportDesc->Name == 0)
return; // This module doesn't import any functions from this callee

// Get caller's import address table (IAT) for the callee's functions
PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)
((PBYTE) hmodCaller + pImportDesc->FirstThunk);

// Replace current function address with new function address
for (; pThunk->u1.Function; pThunk++) {

// Get the address of the function address
PROC* ppfn = (PROC*) &pThunk->u1.Function;

// Is this the function we're looking for?
BOOL fFound = (*ppfn == pfnCurrent);

// if (!fFound && (*ppfn > sm_pvMaxAppAddr)) {

// If this is not the function and the address is in a shared DLL,
// then maybe we're running under a debugger on Windows 98. In this
// case, this address points to an instruction that may have the
// correct address.

// PBYTE pbInFunc = (PBYTE) *ppfn;
// if (pbInFunc[0] == cPushOpCode) {
// // We see the PUSH instruction, the real function address follows
// ppfn = (PROC*) &pbInFunc[1];

// Is this the function we're looking for?
// fFound = (*ppfn == pfnCurrent);
// }
// }

if (fFound) {
// The addresses match, change the import section address
MessageBox(NULL,"Changing!",NULL,NULL);
WriteProcessMemory(GetCurrentProcess(), ppfn, &pfnNew,
sizeof(pfnNew), NULL);
return; // We did it, get out
}
}

// If we get to here, the function is not in the caller's import section
}

void process()
{
PROC oldpfn=GetProcAddress(GetModuleHandle("wsock32.dll"),"gethostbyname");
PROC newpfn=GetProcAddress(GetModuleHandle("hook.dll"),"MY_gethostbyname");
HMODULE exehandle=GetModuleHandle("DD.exe");
ReplaceIATEntryInOneMod("wsock32.dll",oldpfn,newpfn,exehandle);
}
GeneralHyper-threading and MSDev6 Pin
[d3m0n]7-Jul-04 4:55
[d3m0n]7-Jul-04 4:55 
GeneralInstalling fonts .ttf and Type 1 Pin
Anonymous7-Jul-04 4:15
Anonymous7-Jul-04 4:15 
GeneralInstalling fonts .ttf and Type 1 Pin
Anonymous7-Jul-04 4:13
Anonymous7-Jul-04 4:13 
GeneralRe: Installing fonts .ttf and Type 1 Pin
David Crow7-Jul-04 4:47
David Crow7-Jul-04 4:47 
GeneralRe: Installing fonts .ttf and Type 1 Pin
Anonymous7-Jul-04 6:11
Anonymous7-Jul-04 6:11 
GeneralAccessing a web Service from VC++ application Pin
Member 5343577-Jul-04 3:51
Member 5343577-Jul-04 3:51 
GeneralRe: Accessing a web Service from VC++ application Pin
Antti Keskinen7-Jul-04 12:27
Antti Keskinen7-Jul-04 12:27 
GeneralRe: Accessing a web Service from VC++ application Pin
Member 5343578-Jul-04 3:13
Member 5343578-Jul-04 3:13 
GeneralRe: Accessing a web Service from VC++ application Pin
Antti Keskinen8-Jul-04 9:48
Antti Keskinen8-Jul-04 9:48 
QuestionAny suggestions on a parser? Pin
prcarp7-Jul-04 3:16
prcarp7-Jul-04 3:16 
AnswerRe: Any suggestions on a parser? Pin
siggapet7-Jul-04 3:26
siggapet7-Jul-04 3:26 
AnswerRe: Any suggestions on a parser? Pin
palbano7-Jul-04 4:00
palbano7-Jul-04 4:00 
AnswerRe: Any suggestions on a parser? Pin
Andrew Walker7-Jul-04 14:21
Andrew Walker7-Jul-04 14:21 
GeneralRe: Any suggestions on a parser? Pin
prcarp25-Jul-04 20:39
prcarp25-Jul-04 20:39 
QuestionMaking an Edit multiline? Pin
steven117-Jul-04 1:56
steven117-Jul-04 1:56 
AnswerRe: Making an Edit multiline? Pin
siggapet7-Jul-04 3:49
siggapet7-Jul-04 3:49 
GeneralRe: Making an Edit multiline? Pin
steven117-Jul-04 6:06
steven117-Jul-04 6:06 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.