autohook.bas

Cracker终结者——提供最优秀的软件保护技术

Attribute VB_Name = "MainModule"
'You can't write Hook DLLs in Visual Basic for now,
'but you can use ApiHooks APIs to make various
'things with modules and to hook yourself.
'For example you can get ID/Handle to process
'and then load module/hooks (written in C, for example)
'into it.
'Maybe you can create DLL in VB, load it into Target and
'call your code in DLL (via LoadAndCall("ole32", "CoCreateInstance",...)
'Your code can then call HookApi.

Option Explicit

'Public Declare Sub xCopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, ByVal Source As Long, ByVal Length As Long)

Public Declare Function NotMe Lib "MiniGlobal.dll" _
    (ByVal ToNot As Long) As Long

Public Declare Function GetCurrentProcessId Lib "KERNEL32.dll" _
    () As Long

Public Declare Function GetCurrentProcess Lib "KERNEL32.dll" _
    () As Long
    
Public Type LAC_PARAMS
  Param00      As Long
  Param01      As Long
  Param02      As Long
  Param03      As Long
  Param04      As Long
  Param05      As Long
  Param06      As Long
  Param07      As Long
  Param08      As Long
  Param09      As Long
  Param10      As Long
  Param11      As Long
  Param12      As Long
  Param13      As Long
  Param14      As Long
  Param15      As Long
  Param16      As Long
  Param17      As Long
  Param18      As Long
  Param19      As Long
End Type

Public AddrContents(1) As ADDRESS_CONTENTS
Public ApiUnhook As API_UNHOOK

Public Type OneDynamicAPI_HOOK
  DyNamicH     As Long
  Dummy00      As Long
  Dummy01      As Long
  Dummy02      As String
  ExcludeModules As Long
  Dummy03      As Long
  
  ModuleExport As String
  ApiNameOrOrd As String
  dwFlags      As Long
  ModuleImport As String
  UnhookAddresses As Long
  HookAddress  As Long
  
  HooksEnd     As Long
End Type

Public ApiHookChain As OneDynamicAPI_HOOK

Public OrgNotMe As Long
Function NewNotMe(ByVal ToNot As Long) As Long
 MsgBox "Inside hook.", vbOKOnly, "AH in VB"
 NewNotMe = -CallOrigFn(0&, 0&, HOOK_OVERWRITE, OrgNotMe, 0&, 1, ToNot)
End Function
Sub Main()
 Dim lRCI As RCINFO
 lRCI.RCFlags = 0
 
 'Call xCopyMemory(lRCI, GetDefaultRCInfo, Len(lRCI))
  
 Dim AHresult As Long
 If EstablishApiHooks(lRCI, "MiniGlobal.dll", GetCurrentProcessId, 0) = ErrorAWSuccess Then
   MsgBox "Hooks established.", vbOKOnly, "AH in VB"
 Else
   MsgBox "Hooks not established!", vbOKOnly, "AH in VB"
 End If
 
 Dim Parameters As LAC_PARAMS
 Parameters.Param00 = &H12345678
 If LoadAndCall(lRCI, "MiniGlobal.dll", GetCurrentProcessId, 0, 0, "NotMe", 1, Parameters) = Not &H12345678 Then
   MsgBox "LAC succeeded.", vbOKOnly, "AH in VB"
 Else
   MsgBox "LAC failed!", vbOKOnly, "AH in VB"
 End If
 
 MsgBox "MiniGlobal.dll loaded at " + Hex(hIsModuleLoaded(lRCI, "MiniGLobal", GetCurrentProcess, 0)), vbOKOnly, "AH in VB"
 
 ApiUnhook.MaxNoAddr = 2 Or VB6_UNHOOK
 ApiUnhook.CurNoAddr = 0
 ApiUnhook.WhereWhat = AddrContents
 
 If HookApi("MiniGlobal.dll", "NotMe", HOOK_OVERWRITE, OrgNotMe, ApiUnhook, AddressOf NewNotMe, 0&) = ErrorAWSuccess Then
  MsgBox "API NotMe hooked!", vbOKOnly, "AH in VB"
 Else
  MsgBox "API NotMe not hooked!", vbOKOnly, "AH in VB"
 End If
  
 If NotMe(Parameters.Param00) = -Not &H12345678 Then
 'If LoadAndCall(lRCI, "MiniGlobal.dll", GetCurrentProcessId, 0, 0, "NotMe", 1, Parameters) = -Not &H12345678 Then
   MsgBox "Hook succeeded.", vbOKOnly, "AH in VB"
 Else
   MsgBox "Hook failed!", vbOKOnly, "AH in VB"
 End If
 
 If hUnloadModule(lRCI, "MiniGlobal.dll", GetCurrentProcess, 0, 2) = 0 Then
  MsgBox "Module unloaded.", vbOKOnly, "AH in VB"
 Else
  MsgBox "Module not unloaded!", vbOKOnly, "AH in VB"
 End If
 
End Sub