lastbox.cpp

此为本书的配套光盘.本书不但由浅入深地讲解了软件保护技术

/********************************************************************

	Copyright (c) Beijing Feitian Technologies
	http://www.FTSafe.com

	File :		LastBox.cpp	

	Created:	2003/11/05

	Author:		yihai
	
	Purpose:	?

	Revision:	?

*********************************************************************/
// LastBox.cpp : Defines the entry point for the application.
//

#include "stdafx.h"
#include <windows.h>

typedef void (*TPFN_OldEntry)();

extern "C" DWORD	g_shl_old_entry;
extern "C" PDWORD	g_shl_p_old_IAT_addr;
extern "C" DWORD	g_shl_old_IAT_size;

typedef void (WINAPI *TPFN_ExitProcess)(UINT uExitCode );

TPFN_ExitProcess*	g_ppExitProcess=NULL;

char szLstBoxMsg[] = "From Last Box 3 ExitProcess hooked";

void WINAPI ExitProcessHook(UINT nExitCode)
{
	MessageBox(NULL,szLstBoxMsg,"FTSafe",MB_OK);
	(*g_ppExitProcess)(nExitCode);
}

void InstallExitHook()
{
	PDWORD  pStart = g_shl_p_old_IAT_addr;
	DWORD	dwValue = (DWORD)ExitProcess;
	for(DWORD i=0;i<(g_shl_old_IAT_size/4);i++)
	{
		if(*pStart == dwValue)	//如果引入地址为ExitProcesss将它换成我们的HookProc
		{
			*pStart =(DWORD)ExitProcessHook;
		}
		pStart++;
	}
}

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
	MessageBox(NULL,"Shell or encrypt code",NULL,MB_OK);
	InstallExitHook();

	g_ppExitProcess = new TPFN_ExitProcess[1];
	*g_ppExitProcess = ExitProcess;
		
	TPFN_OldEntry pfnOldEntry = (TPFN_OldEntry)g_shl_old_entry;
	pfnOldEntry();	
	
	return 0;
}