bon voilla j ai traduit un source c++
ver Pb pour faire "Hooking Windows API".... son entrée dans les détails le hook est sur "ShellExecuteEx", malheureusement marche pas
,pourtant j'ai tout vérifier?quelqu'un de généreux peut me dire why et merci
Code : Tout sélectionner
;Coder : celtic88 (c)
Import "kernel32.lib"
GetProcAddress_(handle.l, string.p-ascii) As "_GetProcAddress@8"
EndImport
Structure IMAGE_IMPORT_DESCRIPTOR
DUMMYUNIONNAME.d
TimeDateStamp.d
ForwarderChain.d
Name.d
FirstThunk.d
EndStructure
Structure IMAGE_THUNK_DATA
ul.d
EndStructure
Procedure _AddHookApi(ModuleName.s, FunctionName.s, *NewProcAddress)
; Get base address of our app
*hInstance = GetModuleHandle_(0)
Debug *hInstance
;; Get module of the module that the function resides in
*Module = GetModuleHandle_(ModuleName)
Debug *Module
; Get the original function address
*OrigAddress = GetProcAddress_(*Module, FunctionName)
Debug *OrigAddress
;; Get the address of the Import directory
ulSize.l
*ptrtoiid=ImageDirectoryEntryToData_(*hInstance, #True, #IMAGE_DIRECTORY_ENTRY_IMPORT, @ulSize)
Debug *ptrtoiid
*iid.IMAGE_IMPORT_DESCRIPTOR=*ptrtoiid
;; Loop through all loaded modules.
Debug *iid\Name
While *iid\Name
; get the name...
str$ = PeekS(*hInstance + *iid\Name)
; If the name matches, we've found what we're looking for.
If str$ = ModuleName : Break : EndIf
; Move to the next directory item
*ptrtoiid + SizeOf(*iid)
*iid.IMAGE_IMPORT_DESCRIPTOR=*ptrtoiid
Wend
*ptrtoitd = *hInstance + *iid\FirstThunk
*itd.IMAGE_THUNK_DATA= *ptrtoitd
While *itd\ul
; We have found where the original address is stored
If *itd\ul = *OrigAddress
;; Prepare the memory for writing
*mbi.MEMORY_BASIC_INFORMATION
VirtualQuery_(*itd\ul, @*mbi, SizeOf(*mbi))
VirtualProtect_(*mbi\BaseAddress, *mbi\RegionSize,#PAGE_READWRITE, @*mbi\Protect)
;; Here's where the magic happens
*itd\ul= *NewProcAddress
randomdword.d
VirtualProtect_(*mbi\BaseAddress,*mbi\RegionSize,*mbi\Protect, @randomdword)
Break
EndIf
*ptrtoitd + SizeOf(*itd)
*itd.IMAGE_THUNK_DATA= *ptrtoitd
Wend
ProcedureReturn *itd
EndProcedure
Procedure _ChangeHookApi(*ITDSTRUCT.IMAGE_THUNK_DATA, *NewProc)
;; Prepare the memory for writing
*mbi.MEMORY_BASIC_INFORMATION
VirtualQuery_(*ITDSTRUCT\ul, @*mbi, SizeOf(*mbi))
VirtualProtect_(*mbi\BaseAddress, *mbi\RegionSize,#PAGE_READWRITE, @*mbi\Protect)
;; Here's where the magic happens
*ITDSTRUCT\ul= *NewProc
randomdword.d
VirtualProtect_(*mbi\BaseAddress,*mbi\RegionSize,*mbi\Protect, @randomdword)
EndProcedure
Procedure MyTest(*ptr)
*SHELLEXECUTEINFO.SHELLEXECUTEINFO=*ptr
MessageRequester("","Voulez vous exécuter ce fichier : " + str(*SHELLEXECUTEINFO\lpFile))
ProcedureReturn #False
EndProcedure ;==>MyTest
*orig = GetProcAddress_(GetModuleHandle_("shell32.dll"), "ShellExecuteEx")
*hook = _AddHookApi("Shell32.dll", "ShellExecuteExW", @MyTest())
ShellExecute_(#NUL,#NUL,"C:\Users\larbi\Desktop\hhh.jpg",#NUL,#NUL,#NUL)
;_ChangeHookApi(*hook, *orig)
; IDE Options = PureBasic 5.31 (Windows - x86)
; Folding = -
; EnableUnicode
; EnableXP
: 
! 
