ANTICHAT — форум по информационной безопасности, OSINT и технологиям

format PE64 GUI
4.0
DLL
entry DllEntryPoint

include
'C:\FLAT\INCLUDE\win64ax.inc'
section
'.data'
data writeable
    Message db
"hack"
,
0
caption db
"hook"
,
0
user32_dll db
"user32.dll"
,
0
function db
"MessageBoxA"
,
0
dosHeader dq
0
ntHeaders dq
0
section
'.text'
code executable

proc DllEntryPoint hinstDLL
,
reason
,
reserved
    cmp edx
,
1
jne
.
skip
    call installIAT
.
skip
:
mov eax
,
1
ret
endp
// тут хук ставлю без возврата оригинала, для проверки
proc HookMessageBoxA hWnd
,
lpText
,
lpCaption
,
uType
    sub rsp
,
28
h

    xor rcx
,
rcx
    lea rdx
,
[
Message
]
lea r8
,
[
caption
]
xor r9
,
r9
    call
[
MessageBoxA
]
add rsp
,
28
h
endp
// парсинг IAT
installIAT
:
sub rsp
,
28
h

    xor rcx
,
rcx
    call
[
GetModuleHandle
]
mov
[
dosHeader
]
,
rax
    mov edi
,
dword
[
rax
+
3
Ch
]
add rax
,
rdi
    mov
[
ntHeaders
]
,
rax

    mov eax
,
dword
[
rax
+
90
h
]
add rax
,
[
dosHeader
]
mov rsi
,
rax
.
dll_loop
:
mov eax
,
dword
[
rsi
+
12
h
]
test eax
,
eax
    jz
.
error
    mov rdi
,
[
dosHeader
]
add rdi
,
rax

    mov rbx
,
[
dosHeader
]
add ebx
,
dword
[
rsi
+
10
h
]
.
loop_IAT
:
invoke GetProcAddress
,

,
function
    cmp
[
rbx
]
,
rax
    je
.
patch
    add rbx
,
8
jmp
.
loop_IAT
.
patch
:
lea r9
,
[
ntHeaders
]
mov rcx
,
rbx
    mov rdx
,
8
mov r8
,
40
h
    call
[
VirtualProtect
]
lea rax
,
[
HookMessageBoxA
]
mov
[
rbx
]
,
rax
    jmp
.
error
.
error
:
add rsp
,
28
h
    ret
    
section
'.idata'
import data readable

library kernel32
,
'KERNEL32.DLL'
,
\
        user32
,
'USER32.DLL'
import kernel32
,
\
       GetModuleHandle
,
'GetModuleHandleA'
,
\
       GetProcAddress
,
'GetProcAddress'
,
\
       VirtualProtect
,
'VirtualProtect'
import user32
,
\
       MessageBoxA
,
'MessageBoxA'
section
'.reloc'
fixups data readable discardable