(VB)如何拦截API呼叫

如何攔截API呼叫說明這是網友問的問題,雖然這個問題並不適合用VB做,但並不是做不到,要多繞一段路,這個問於執行檔中的IAT(Import Address Table) 如果你對於PE黨並不熟悉請參考PE檔簡介這一個Process再執行時,會將許多DLL載入到行程空間中,如呼叫User32.dll中的Message 須將User32.dll載入到位址空間,呼叫越多不同種的API,位址空間中的模組也就越多,至於行程所載入的模組請參考如何取得Process中載入的模組的資訊一般來說,如果是執行Notepad.exe 我們只要攔截模組Notepad.exe的IAT即可,除非你想Notepad.exe是否有透過其他DLL去執行要攔截的函數,才需要去攔截其他載入的模組這個程式整個攔截的過程如下1.在要攔截的程式上配置2塊記憶體空間,一塊用來放要攔截的程式,一塊用來放所需要域變數至於如何再外部程式配置記憶體請參考如何在外部程式配置記憶體AddressOfRemoteFunction=CreateRemoteMememory(SomeProcess,FunctionSize)AddressOfVar=CreateRemoteMememory(SomeProcess,DataSize)2.將要注射的函數寫到配置的位址空間並初使化變數Call WriteCodeTo(AddressOfRemoteFunction)[AddressOfVar]=1[AddressOfVar+256]=Old_FunctionAddress3.修改IAT位址到新配置的函數IAT[FunctionOrder]=AddressOfRemoteFunction4.監聽變數情形(注射的函數執行時會將[AddressOfVar]改為0)DoDoeventsLoop While [AddressOfVar] '不為0就繼續監視'為0時表示已經呼叫該函數MsgBox "抓到了"5.停止監視或繼續監視If StopHook Then[AddressOfVar]=1 '先讓Remote程式繼續執行IAT[FunctionIndex]=Old_FunctionAddress '恢復為原來位址Else[AddressOfVar]=1Goto Step4 '到步驟4繼續監視End If至於所注射的程式內容如下push eax ;先暫存Eax的值mov eax, 00000000 ;歸0mov dword ptr [AddressOfVar], eax ;將變數改為0 此時監視程式即可發覺lp1:cmp eax, dword ptr [AddressOfVar]je lp1;在監視程式未將變數改為1之前無限等待pop eax ;恢復eax的值;跳到原程式位址執行jmp dword ptr [AddressOfVar+256] ;其中=原來函數位址該注射函數必須用機器碼的方式填到位址中,如果不會轉換的話,請顯用編譯器將此組合語言譯後在取得他的機器碼即可此程式操作方法如下6.開啟記事本7.攔截行程選擇notepad.exe8.攔截模組也是選擇notepad.exe9.攔截函數選擇MessageBoxW - [USER32.dll]如果是9x系統請選擇MessageBoxA - [USER32.dll] 情形大概是這樣10.11.按下攔截12.在記事本視窗中隨便打上一些字然後將這個視窗關掉13.此時Hook程式就會攔截到而跳出以下訊息方塊14.15.此時只要按下確定就可以繼續攔截下次此函數的呼叫或是按下取消放棄監視程式16.當step8執行完後原MessageBox才會跳出來17.註:這個程式我是在XP底下開發的並沒有在9x的機器上測試如果在9x上執行會出問題請我程式'以下程式在Form中需要2個Command,3個ComboBoxOption ExplicitDim o As LongDim lret As LongDim cModules As LongDim lModuleBase() As LongDim cbModules As LongDim mImp As IMAGE_IMPORT_DESCRIPTORDim n_Addr1 As Long, n_Addr2 As LongDim Imp_p() As mImp_TableDim NumOfImp As LongDim RMM As myRemoteClsPrivate Sub Combo1_Click()Dim lIndex As LonglIndex = Combo1.ListIndexn_ProcessID = lProcessID(lIndex)Combo2.SetFocusEnd SubPrivate Sub Combo1_GotFocus()Combo1.ClearNum_Of_Process = 0Dim sName As StringDim hSnap As Long, proc As PROCESSENTRY32hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)If hSnap = hNull Then Exit Subproc.dwSize = Len(proc)If Process32First(hSnap, proc) ThenDosName = Trim0(proc.szExeFile)Combo1.AddItem "PID:" & Format(proc.th32ProcessID, "00000000") & " "ReDim Preserve lProcessID(Num_Of_Process)lProcessID(Num_Of_Process) = proc.th32ProcessIDNum_Of_Process = Num_Of_Process + 1Loop While Process32Next(hSnap, proc)End IfEnd SubPublic Sub GetModule(ByVal ProcessID As Long)Dim hSnapshot As LonghSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, ProcessID)If hSnapshot = -1 ThenExit SubEnd IfDim sModuleName As StringDim ModEntry As MODULEENTRY32ModEntry.dwSize = LenB(ModEntry)If Module32First(hSnapshot, ModEntry) ThencbModules = 1DoReDim Preserve lModuleBase(1 To cbModules)sModuleName = Left$(ModEntry.szModule, InStr(1, ModEntry.szModule, Chr( lModuleBase(cbModules) = ModEntry.modBaseAddrbo2.AddItem sModuleName & "Module Bass Address:" & lModuleBase(cb cbModules = cbModules + 1Loop While Module32Next(hSnapshot, ModEntry)End IfCloseHandle hSnapshotEnd SubPrivate Sub Combo2_Click()Dim i As Longi = Combo2.ListIndexn_ModuleAddress = lModuleBase(i + 1)MsgBox n_ModuleAddressCombo3.SetFocusEnd SubPrivate Sub Combo2_GotFocus()Combo2.ClearGetModule n_ProcessIDEnd SubSub GetImports()Dim hProcess As LongDim o As DOS_MZ_HEADERDim p As PE_File_HeaderDim ord As Integer, i As Long, j As Long, tm As LongDim AddrFunc As LonghProcess = OpenProcess(PROCESS_ALL_ACCESS, 0&, n_ProcessID)If hProcess ThenReadProcessMemory hProcess, ByVal n_ModuleAddress, o, Len(o), tm '讀取DosIf o.e_magic <> "MZ" ThenMsgBox "Dos MZ 檔頭錯誤"Exit SubEnd If'Public Type PE_File_Header' SECTION As Long 'pe' FILE_HEADER As IMAGE_FILE_HEADER' OPTIONAL As IMAGE_OPTIONAL_HEADER' DataDirectory(0 To 15) As IMAGE_DATA_DIRECTORY '100'End Type'讀取PE Header 有四部份'讀取部分一ReadProcessMemory hProcess, ByVal n_ModuleAddress + o.e_lfanew, p.SECTION, Len(p.SECTION), tm '讀取部分一If p.SECTION <> PEMAGIC ThenMsgBox "PE檔頭錯誤"Exit SubEnd If'讀取部分二 IMAGE_FILE_HEADERReadProcessMemory hProcess, ByVal n_ModuleAddress + o.e_lfanew + Len(p.SECT p.FILE_HEADER, Len(p.FILE_HEADER), tm'讀取部分三 IMAGE_OPTIONAL_HEADERReadProcessMemory hProcess, ByVal n_ModuleAddress + o.e_lfanew + Len(p.SECT Len(p.FILE_HEADER), p.OPTIONAL, Len(p.OPTIONAL), tm'讀取部分四 IMAGE_DATA_DIRECTORYReadProcessMemory hProcess, ByVal n_ModuleAddress + o.e_lfanew + Len(p.SECT Len(p.FILE_HEADER) + Len(p.OPTIONAL), p.DataDirectory(0), Len(p.DataDirectory(0)Dim lDll As Long 'Import第幾個DllDim sName As String, sAddr As LongErase Imp_pNumOfImp = 0Dim ITD As IMAGE_IMPORT_BY_NAMEDim IAT As IMAGE_IMPORT_BY_ADDR'讀取Ord以及Function NameDim ts() As ByteReDim ts(260)Dim lOr As LongDim ILP_Address As Long, lpAddress As LongDim sModuleName As StringDo'讀取Import的部分ReadProcessMemory hProcess, ByVal n_ModuleAddress +p.DataDirectory(1).VirtualAddress + lDll * Len(mImp), mImp, Len(mImp), tmIf = 0 And mImp.OriginalFirstThunk = 0 Then Exit DoReadProcessMemory hProcess, ByVal n_ModuleAddress + , ts(0), 2 sModuleName = LPSTRtoBSTR(VarPtr(ts(0)))lDll = lDll + 1lOr = 0Do'讀取Import Lockup Table的Address 結構ReadProcessMemory hProcess, ByVal n_ModuleAddress + mImp.OriginalFir lOr * 4, ILP_Address, Len(ILP_Address), tmIf ILP_Address = 0 Then Exit DoReDim Preserve Imp_p(NumOfImp)'讀取OriginalFirstThunk所指的IMAGE_THUNK_DATA 結構Dim pon As Currency, lop As Longpon = n_ModuleAddresspon = pon + ILP_AddressIf pon > &H7FFFFFFF Thenpon = pon - &H7FFFFFFF - &H7FFFFFFF - 2End Iflop = ponReadProcessMemory hProcess, ByVal lop, ITD, Len(ITD), tm'紀錄HintImp_p(NumOfImp).lHint = ITD.Hint'讀取API NamesName = LPSTRtoBSTR(VarPtr(1(0)))Imp_p(NumOfImp).sFunctionName = sName & " - [" & sModuleName & "] Imp_p(NumOfImp).lIAT_Address = n_ModuleAddress + mImp.FirstThunk + Combo3.AddItem Imp_p(NumOfImp).sFunctionNameNumOfImp = NumOfImp + 1lOr = lOr + 1LoopLoopCloseHandle hProcessElseMsgBox "無訪開啟該Process"End IfEnd SubFunction LPSTRtoBSTR(ByVal lpsz As Long) As StringDim cChars As LongcChars = lstrlenA(lpsz)LPSTRtoBSTR = String$(cChars, 0)CopyMemory ByVal StrPtr(LPSTRtoBSTR), ByVal lpsz, cCharsLPSTRtoBSTR = Trim0(StrConv(LPSTRtoBSTR, vbUnicode))End FunctionPrivate Sub Combo3_Click()n_index = Combo3.ListIndexEnd SubPrivate Sub Combo3_GotFocus()Combo3.ClearGetImportsEnd Sub'將Long型態的變數寫到OpCode種Public Sub WLongToCode(hProcess As Long, lIndex As Long, ByVal lData As Long) Dim yu As LongWriteProcessMemory hProcess, ByVal lIndex, lData, 4&, yulIndex = lIndex + 4End Sub'將Byte型態的變數寫到OpCode種Public Sub WByteToCode(hProcess As Long, lIndex As Long, ByVal bData As Byte) Dim yu As LongWriteProcessMemory hProcess, ByVal lIndex, bData, 1&, yulIndex = lIndex + 1End SubPrivate Sub Command1_Click()Dim hProcess As Long, tm As Long, Data4 As LongCommand1.Enabled = FalseDim lFunc As Long, lVarAdd As Long, tmNuAdd As Longn_Ex = FalsehProcess = OpenProcess(PROCESS_ALL_ACCESS, 0&, n_ProcessID)If hProcess ThenReadProcessMemory hProcess, ByVal Imp_p(n_index).lIAT_Address, n_Old_Addres Len(n_Old_Address), tmMsgBox "old Address is" & Hex(n_Old_Address)lFunc = CreateMemory(n_ProcessID, 4096) '注射函數lVarAdd = CreateMemory(n_ProcessID, 4096) '注射變數'先將外部變數設為1 當攔截到API時變數會被設成0Data4 = 1WriteProcessMemory hProcess, ByVal lVarAdd, Data4, Len(Data4), tm'將函數原位址寫到lVarAdd + 256WriteProcessMemory hProcess, ByVal lVarAdd + 256, n_Old_Address, Len(n_Old_A tm'寫入攔截函數'----------------------------------------------------------------------- tmNuAdd = lFunc'Int 3'WByteToCode hProcess, tmNuAdd, &HCC'push eaxWByteToCode hProcess, tmNuAdd, &H50'mov eax, 00000000WByteToCode hProcess, tmNuAdd, &HB8WLongToCode hProcess, tmNuAdd, &H0'mov dword ptr [lVarAdd], eaxWByteToCode hProcess, tmNuAdd, &HA3WLongToCode hProcess, tmNuAdd, lVarAdd'lp1:'cmp eax, dword ptr [lVarAdd]WByteToCode hProcess, tmNuAdd, &H3BWByteToCode hProcess, tmNuAdd, &H5WLongToCode hProcess, tmNuAdd, lVarAdd'je lp1WByteToCode hProcess, tmNuAdd, &H74WByteToCode hProcess, tmNuAdd, &HF8'pop eaxWByteToCode hProcess, tmNuAdd, &H58'Int 3'WByteToCode hProcess, tmNuAdd, &HCC'jmp dword ptr [lVarAdd + 256] ;其中[lVarAdd + 256]=原來函數位址WByteToCode hProcess, tmNuAdd, &HFFWByteToCode hProcess, tmNuAdd, &H25WLongToCode hProcess, tmNuAdd, lVarAdd + 256 ''--------------------------------------------------------------------------'修改IAT AddressWriteProcessMemory hProcess, ByVal Imp_p(n_index).lIAT_Address, lFunc, Len(l'攔截處理Dim bProcessMemory As Long, RtnVDo'等待函數被攔截DoIf ReadProcessMemory(hProcess, ByVal lVarAdd, bProcessMemory,Len(bProcessMemory), tm) = 0 ThenMsgBox "嚴重錯誤"GoTo ExpEnd IfDoEventsIf n_Ex ThenGoTo ExpEnd IfLoop While bProcessMemoryMe.ShowRtnV = MsgBox("攔截到目標程式呼叫" & Imp_p(n_index).sFunctionName & vbC"要繼續攔截下次呼叫?", vbOKCancel, "抓到了")If RtnV = vbCancel ThenWriteProcessMemory hProcess, ByVal Imp_p(n_index).lIAT_Address,n_Old_Address, Len(n_Old_Address), tmbProcessMemory = 1WriteProcessMemory hProcess, ByVal lVarAdd, bProcessMemory,Len(bProcessMemory), tmExit DoEnd IfbProcessMemory = 1WriteProcessMemory hProcess, ByVal lVarAdd, bProcessMemory, Len(bProcess tmDoEventsLoopExp:DeleteMemory n_ProcessID, lFuncDeleteMemory n_ProcessID, lVarAddCloseHandle hProcessElseMsgBox "無訪開啟該Process"End IfCommand1.Enabled = TrueEnd SubPublic Function CreateMemory(ByVal ProcessID As Long, ByVal mSize As Long) As L CreateMemory = RMM.RemortMemoryAlloc(ProcessID, mSize)End FunctionPublic Sub DeleteMemory(ByVal ProcessID As Long, ByVal da As Long)RMM.RemortMemoryRemove ProcessID, daEnd SubPrivate Sub Command2_Click()Dim hProcess As Long, tm As LonghProcess = OpenProcess(PROCESS_ALL_ACCESS, 0&, n_ProcessID)If hProcess ThenWriteProcessMemory hProcess, ByVal Imp_p(n_index).lIAT_Address, n_Old_Addre Len(n_Old_Address), tmCloseHandle hProcessn_Ex = TrueElseMsgBox "無法開啟該Process"End IfEnd SubPrivate Sub Form_Load()Set RMM = New myRemoteClsEnd Sub'以下程式在Module1.bas中Public Const PROCESS_QUERY_INFORMATION = 1024Public Const PROCESS_VM_READ = 16Public Const STANDARD_RIGHTS_REQUIRED = &HF0000Public Const SYNCHRONIZE = &H100000Public Const PROCESS_ALL_ACCESS = &H1F0FFFPublic Const TH32CS_SNAPPROCESS = &H2&Public Const hNull = 0Public Const MAX_PATH = 260Public Const MAX_MODULE_NAME32 = 255Public Type MODULEENTRY32dwSize As Longth32ModuleID As Longth32ProcessID As LongGlblcntUsage As LongProccntUsage As LongmodBaseAddr As LongmodBaseSize As LonghModule As LongszModule As String * MAX_MODULE_NAME32szExePath As String * MAX_PATHEnd TypePublic Const TH32CS_SNAPHEAPLIST = &H1Public Const TH32CS_SNAPTHREAD = &H4Public Const TH32CS_SNAPMODULE = &H8Public Const TH32CS_SNAPALL = (TH32CS_SNAPHEAPLIST Or TH32CS_SNAPPROCESS Or TH32CS_SNAPTHREAD Or TH32CS_SNAPMODULE)Public Const TH32CS_INHERIT = &H80000000Public Declare Function Module32First Lib "kernel32" (ByVal hSnapshot As Long, MODULEENTRY32) As LongPublic Declare Function Module32Next Lib "kernel32" (ByVal hSnapshot As Long, l MODULEENTRY32) As LongPublic lProcessID() As LongPublic Num_Of_Process As LongPublic n_ProcessID As LongPublic n_ModuleAddress As LongPublic n_index As LongPublic n_Old_Address As LongPublic n_Ex As BooleanPublic Function Trim0(sName As String) As StringDim x As Integerx = InStr(sName, Chr$(0))If x > 0 Then Trim0 = Left$(sName, x - 1) Else Trim0 = sName End Function'以下程式在Module2.bas中Option ExplicitPublic Const IMAGE_DOS_SIGNATURE As Integer = &H5A4D ' MZ Public Const IMAGE_OS2_SIGNATURE As Integer = &H454E ' NE Public Const IMAGE_OS2_SIGNATURE_LE As Integer = &H454C 'LE Public Const IMAGE_NT_SIGNATURE As Long = &H4550 ' PE00Public Type DOS_MZ_HEADERe_magic As String * 2 ' Magic numbere_cblp As Integer 'Bytes on last page of filee_cp As Integer 'Pages in filee_crlc As Integer 'Relocationse_cparhdr As Integer 'Size of header in paragraphse_minalloc As Integer ' Minimum extra paragraphs needed e_maxalloc As Integer ' Maximum extra paragraphs needed e_ss As Integer 'Initial (relative) SS valuee_sp As Integer 'Initial SP valuee_csum As Integer 'Checksume_ip As Integer 'Initial IP valuee_cs As Integer 'Initial (relative) CS valuee_lfarlc As Integer 'File address of relocation tablee_ovno As Integer 'Overlay numbere_res(0 To 3) As Integer 'Reserved wordse_oemid As Integer 'OEM identifier (for e_oeminfo)e_oeminfo As Integer 'OEM information; e_oemid specific e_res2(0 To 9) As Integer 'Reserved wordse_lfanew As Long ' File address of new exe headerEnd Type'CPU TypePublic Const CPU_UNKNOW As Integer = &H0Public Const CPU_80386 As Integer = &H14CPublic Const CPU_80486 As Integer = &H14DPublic Const CPU_Pentium As Integer = &H14EPublic Const CPU_MIPS_R2000 As Integer = &H162Public Const CPU_MIPS_R3000 As Integer = &H162Public Const CPU_MIPS_R6000 As Integer = &H163Public Const CPU_MIPS_R4000 As Integer = &H166Public Const IMAGE_SIZEOF_SHORT_NAME = 8Public Type IMAGE_SECTION_HEADERName As String * IMAGE_SIZEOF_SHORT_NAMEPhysicalAddress_or_VirtualSize As Long 'or VirtualSize VirtualAddress As LongSizeOfRawData As LongPointerToRawData As LongPointerToRelocations As LongPointerToLinenumbers As LongNumberOfRelocations As IntegerNumberOfLinenumbers As IntegerCharacteristics As LongEnd Type'Image Section typePublic Const IMAGE_SCN_CNT_CODE As Long = &H20Public Const IMAGE_SCN_CNT_INITIALIZED_DATA As Long = &H40 Public Const IMAGE_SCN_CNT_UNINITIALIZED_DATA As Long = &H80 Public Const IMAGE_SCN_LNK_INFO As Long = &H200Public Const IMAGE_SCN_LNK_REMOVE As Long = &H800Public Const IMAGE_SCN_LNK_COMDAT As Long = &H1000Public Const IMAGE_SCN_MEM_FARDATA As Long = &H8000Public Const IMAGE_SCN_MEM_PURGEABLE As Long = &H20000 Public Const IMAGE_SCN_MEM_LOCKED As Long = &H40000Public Const IMAGE_SCN_MEM_PRELOAD As Long = &H80000Public Const IMAGE_SCN_LNK_NRELOC_OVFL As Long = &H1000000 Public Const IMAGE_SCN_MEM_DISCARDABLE As Long = &H2000000 Public Const IMAGE_SCN_MEM_NOT_CACHED As Long = &H4000000 Public Const IMAGE_SCN_MEM_NOT_PAGED As Long = &H8000000 Public Const IMAGE_SCN_MEM_SHARED As Long = &H10000000 Public Const IMAGE_SCN_MEM_EXECUTE As Long = &H20000000 Public Const IMAGE_SCN_MEM_READ As Long = &H40000000Public Const IMAGE_SCN_MEM_WRITE As Long = &H80000000 Public Type IMAGE_IMPORT_DESCRIPTOROriginalFirstThunk As LongTimeDateStamp As LongForwarderChain As LongName As LongFirstThunk As LongEnd TypePublic Type IMAGE_IMPORT_BY_NAMEHint As IntegerName1(256) As ByteEnd TypePublic Type IMAGE_IMPORT_BY_ADDR'Hint As IntegerADDR As LongEnd TypePublic Type IMAGE_FILE_HEADERMachine As IntegerNumberOfSections As IntegerTimeDateStamp As LongPointerToSymbolTable As LongNumberOfSymbols As LongSizeOfOptionalHeader As IntegerCharacteristics As IntegerEnd Type'-----------------------------------------------' COFF File headerPublic Type IMAGE_COFF_HEADER ' 20 bytesMachine As IntegerNumberOfSections As IntegerTimeDateStamp As LongPointerToSymbolTable As LongNumberOfSymbols As LongSizeOfOptionalHeader As IntegerCharacteristics As IntegerEnd TypePublic Const IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 15'FLAGSPublic Const IMAGE_FILE_RELOCS_STRIPPED As Integer = &H1 Public Const IMAGE_FILE_EXECUTABLE_IMAGE As Integer = &H2 Public Const IMAGE_FILE_LINE_NUMS_STRIPPED As Integer = &H4Public Const IMAGE_FILE_LOCAL_SYMS_STRIPPED As Integer = &H8 Public Const IMAGE_FILE_AGGRESIVE_WS_TRIM As Integer = &H10Public Const IMAGE_FILE_BYTES_REVERSED_LO As Integer = &H80Public Const IMAGE_FILE_32BIT_MACHINE As Integer = &H100Public Const IMAGE_FILE_DEBUG_STRIPPED As Integer = &H200Public Const IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP As Integer = &H400 Public Const IMAGE_FILE_NET_RUN_FROM_SWAP As Integer = &H800 Public Const IMAGE_FILE_SYSTEM As Integer = &H1000Public Const IMAGE_FILE_DLL As Integer = &H2000Public Const IMAGE_FILE_UP_SYSTEM_ONLY As Integer = &H4000'SUB_SYSTEMPublic Const SUB_SYS_UNKNOW As Integer = &H0Public Const SUB_SYS_NATIVE As Integer = &H1Public Const SUB_SYS_WINDOWS_GUI As Integer = &H2Public Const SUB_SYS_WINDOWS_CHARACTER As Integer = &H3Public Const SUB_SYS_OS2_CHARACTER As Integer = &H5Public Const SUB_SYS_POSIX_CHARACTER As Integer = &H7'DLL FlagsPublic Const DLL_FLAGS_PRE_PROCESS_INIT As Integer = &H1Public Const DLL_FLAGS_PRE_PROCESS_TER As Integer = &H2Public Const DLL_FLAGS_PRE_THREAD_INIT As Integer = &H4Public Const DLL_FLAGS_PRE_THREAD_TER As Integer = &H8Public Type IMAGE_DATA_DIRECTORYVirtualAddress As LongSize As LongEnd TypePublic Type IMAGE_OPTIONAL_HEADERMagic As IntegerMajorLinkerVersion As ByteMinorLinkerVersion As ByteSizeOfCode As LongSizeOfInitializedData As LongSizeOfUninitializedData As LongAddressOfEntryPoint As LongBaseOfCode As LongBaseOfData As Long' NT additional fields.24ImageBase As Long '28SectionAlignment As Long '32FileAlignment As Long '36MajorOperatingSystemVersion As IntegerMinorOperatingSystemVersion As Integer '40MajorImageVersion As IntegerMinorImageVersion As Integer '44MajorSubsystemVersion As IntegerMinorSubsystemVersion As Integer '48Reserved1 As Long '56SizeOfImage As Long '60SizeOfHeaders As Long '64CheckSum As Long '68Subsystem As Integer '70DllCharacteristics As Integer '72SizeOfStackReserve As Long '76SizeOfStackCommit As Long '80SizeOfHeapReserve As Long '84SizeOfHeapCommit As Long '88LoaderFlags As Long '92NumberOfRvaAndSizes As Long '96End TypePublic Type PE_File_HeaderSECTION As Long 'peFILE_HEADER As IMAGE_FILE_HEADEROPTIONAL As IMAGE_OPTIONAL_HEADERDataDirectory(0 To IMAGE_NUMBEROF_DIRECTORY_ENTRIES) As IMAGE_DATA_DIRECTOR End Type'---------------------------------------------------Public Type IMAGE_NT_HEADERSSignature As LongFileHeader As IMAGE_FILE_HEADEROptionalHeader As IMAGE_OPTIONAL_HEADERDataDirectory(0 To IMAGE_NUMBEROF_DIRECTORY_ENTRIES) As IMAGE_DATA_DIRECTOR End TypePublic Type IMAGE_PE_FILE_HEADER ' 256 bytesSignature As Long ' 4 bytes -- PE signatureFileHeader As IMAGE_COFF_HEADER ' 20 bytes -- This is the COFF he OptionalHeader As IMAGE_OPTIONAL_HEADER ' 232 bytesEnd TypePublic Type IMAGE_EXPORT_DIRECTORYCharacteristics As LongTimeDateStamp As LongMajorVersion As IntegerMinorVersion As IntegerName As LongBase As LongNumberOfNames As LongNumberOfFunctions As LongAddressOfFunctions As LongAddressOfNames As LongAddressOfNameOrdinals As LongEnd TypePublic Const ENEWHDR As Long = &H3C '/* offset of new EXE header */Public Const EMAGIC As Integer = &H5A4D '/* old EXE magic id: 'MZ' */Public Const PEMAGIC As Long = &H4550 '/* NT portable executable */ Public Const PAGE_NOACCESS = &H1Public Const PAGE_READONLY = &H2Public Const PAGE_READWRITE = &H4Public Const PAGE_WRITECOPY = &H8Public Const PAGE_EXECUTE = &H10Public Const PAGE_EXECUTE_READ = &H20Public Const PAGE_EXECUTE_READWRITE = &H40Public Const PAGE_EXECUTE_WRITECOPY = &H80Public Const PAGE_GUARD = &H100Public Const PAGE_NOCACHE = &H200Public Const MEM_COMMIT = &H1000Public Const MEM_RESERVE = &H2000Public Const MEM_DECOMMIT = &H4000Public Const MEM_RELEASE = &H8000Public Const MEM_FREE = &H10000Public Const MEM_PRIVATE = &H20000Public Const MEM_MAPPED = &H40000Public Const MEM_RESET = &H80000Public Const MEM_TOP_DOWN = &H100000Public Const MEM_4MB_PAGES = &H80000000Public Declare Function VirtualAllocEx Lib "kernel32" (ByVal hProcess As Long, l As Any, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As LongPublic Declare Function VirtualFreeEx Lib "kernel32" (ByVal hProcess As Long, lpA Any, ByVal dwSize As Long, ByVal dwFreeType As Long) As LongPublic Declare Function GetLastError Lib "kernel32" () As Long' ----------' API errors' ----------Public Const FORMAT_MESSAGE_FROM_SYSTEM = &H1000Public Const FORMAT_MESSAGE_IGNORE_INSERTS = &H200Declare Function FormatMessage Lib "kernel32" Alias "FormatMessageA" ( _ByVal dwFlags As Long, lpSource As Any, ByVal dwMessageId As Long, _ByVal dwLanguageId As Long, ByVal lpBuffer As String, _ByVal nSize As Long, ByVal Arguments As Long) As LongPublic Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" lpModuleName As String) As LongPublic Declare Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As LongPublic Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, B lpProcName As String) As LongPublic Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (By lpPrevWndFunc As Long, ByVal hwnd As Long, ByVal Msg As Long, ByVal wParam As Lo lParam As Long) As LongPublic Declare Function FreeLibrary Lib "kernel32" (ByVal hLibModule As Long) A Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (lpDest As Any, As Any, ByVal cBytes As Long)Public Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Lon lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As LongPublic Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Lo lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As LongPublic Const LOADLIBRARY16_ORD As Integer = 35Public Const FREELIBRARY16_ORD As Integer = 36Public Const GETPROCADDRESS16_ORD As Integer = 37Public opIndex As Long '寫入位置Dim OpCode() As Byte 'Assembly 的OPCODEPublic Type Exp_TabsFunctionName As StringlOrd As IntegerEnd TypePublic Type mImp_TablelIAT_Address As LongsFunctionName As StringlHint As IntegerEnd Type'以下程式在myRemoteCls.cls中Option ExplicitPrivate Declare Function VirtualAllocEx Lib "kernel32" (ByVal hProcess As Long, l As Any, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As LongPrivate Declare Function VirtualFreeEx Lib "kernel32" (ByVal hProcess As Long, l As Any, ByVal dwSize As Long, ByVal dwFreeType As Long) As Long'Process 操作Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Lon bInheritHandle As Long, ByVal dwProcessId As Long) As LongPrivate Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) AsPrivate Type OSVERSIONINFOdwOSVersionInfoSize As LongdwMajorVersion As LongdwMinorVersion As LongdwBuildNumber As LongdwPlatformId As LongszCSDVersion As String * 128 ' Maintenance string for PSS usage End TypePrivate Declare Function GetVersionEx Lib "kernel32" Alias "GetVersionExA" _ (lpVersionInformation As OSVERSIONINFO) As LongPrivate Const VER_PLATFORM_WIN32_NT = 2Private Const VER_PLATFORM_WIN32_WINDOWS = 1Private Const VER_PLATFORM_WIN32s = 0Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination Source As Long, ByVal Length As Long)Private Declare Function CreateFileMapping Lib "kernel32" Alias "CreateFileMapping hFile As Long, lpFileMappigAttributes As Any, ByVal flProtect As Long, ByVal dwMaximumSizeHigh As Long, ByVal dwMaximumSizeLow As Long, ByVal lpName As String Private Declare Function MapViewOfFile Lib "kernel32" (ByVal hFileMappingObject ByVal dwDesiredAccess As Long, ByVal dwFileOffsetHigh As Long, ByVal dwFileOffs Long, ByVal dwNumberOfBytesToMap As Long) As LongPrivate Declare Function UnmapViewOfFile Lib "kernel32" (lpBaseAddress As Any) Private Const GENERIC_READ = &H80000000Private Const GENERIC_WRITE = &H40000000Private Const OPEN_ALWAYS = 4Private Const FILE_ATTRIBUTE_NORMAL = &H80Private Const SECTION_MAP_WRITE = &H2Private Const FILE_MAP_WRITE = SECTION_MAP_WRITEPrivate Const PAGE_READWRITE As Long = &H4Private Const MEM_HANDLE As Long = &HFFFFFFFFPrivate Declare Function CoCreateGuid Lib "ole32.dll" (lpGUID As Any) As Long Private Declare Function StringFromGUID2 Lib "ole32" (lpGUID As Any, ByVal lpStr A ByVal lSize As Long) As LongPrivate Type FileMapiCount As IntegerAddressOfFileMap() As LonghFileMap() As LongtProcessID() As LongiIndex As IntegerEnd TypeDim UseMap As FileMap'Process 參數Private Const STANDARD_RIGHTS_REQUIRED = &HF0000Private Const SYNCHRONIZE = &H100000Private Const SPECIFIC_RIGHTS_ALL = &HFFFFPrivate Const STANDARD_RIGHTS_ALL = &H1F0000Private Const PROCESS_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED Or SYNCHRONIZE Or & Private Const PROCESS_VM_OPERATION = &H8&Private Const PROCESS_VM_READ = &H10&Private Const PROCESS_VM_WRITE = &H20&Private Const PROCESS_QUERY_INFORMATION = 1024'記憶體型態Private Const MEM_COMMIT = &H1000Private Const MEM_RESERVE = &H2000Private Const MEM_DECOMMIT = &H4000Private Const MEM_RELEASE = &H8000Private Const MEM_FREE = &H10000Private Const MEM_PRIVATE = &H20000Private Const MEM_MAPPED = &H40000Private Const MEM_RESET = &H80000Private Const MEM_TOP_DOWN = &H100000Private Const MEM_4MB_PAGES = &H80000000Private Const SEC_IMAGE = &H1000000。