ah c vrai j'ai specifier j'ai xp j'ai reussi a trouvant kelke source a commencer le code ainsi
j'utilise apihijack + ce code ci
#define WIN32_LEAN_AND_MEAN #define _WIN32_WINNT 0x0500 #include <windows.h> #include <shlwapi.h> #include <winternl.h> #include "hookdll.h" #include "apihijack.h"
typedef NTSTATUS (*NtQuerySystemInformation_t)( SYSTEM_INFORMATION_CLASS SystemInformationClass, void *pSystemInformation, unsigned long lSystemInformationLength, unsigned long *lReturnLength);
NTSTATUS MyNtQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, void *pSystemInformation, unsigned long lSystemInformationLength, unsigned long *lReturnLength); enum { NTDLL_NtQuerySystemInformation=0 };
SDLLHook NTDLLHook= { "ntdll.dll", false, NULL, { { "NtQuerySystemInformation", MyNtQuerySystemInformation }, { NULL, NULL } } };
NTSTATUS MyNtQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, void *pSystemInformation, unsigned long lSystemInformationLength, unsigned long *lReturnLength) { NtQuerySystemInformation_t pfnOld=(NtQuerySystemInformation_t)NTDLLHook.Functions[NTDLL_NtQuerySystemInformation].OrigFn; NTSTATUS ntRet=pfnOld(SystemInformationClass, pSystemInformation, lSystemInformationLength, lReturnLength); return ntRet; }
bool APIENTRY DllMain(HINSTANCE hModule, unsigned long fdwReason, void *lpReserved) { char szBuf[MAX_PATH]; if(fdwReason==DLL_PROCESS_ATTACH) { g_hDLL=hModule; DisableThreadLibraryCalls(hModule); GetModuleFileName(GetModuleHandle(NULL), szBuf, sizeof(szBuf)); PathStripPath(szBuf); // if(!stricmp(szBuf, "taskmgr.exe")) HookAPICalls(&NTDLLHook); } return true; }
mais sa me donne erreur et je ne suis pas sur de saisir e principe a 100%
roudy
|