unhookdll.asm

window编程,非常的好

;@GOTO TRANSLATE

.586P

.MODEL            FLAT, STDCALL

   OPTION         CASEMAP: NONE
   INCLUDE        WINDOWS.inc
   UNICODE        = TRUE
   INCLUDE        APIMACRO.mac

   INCLUDE        ApiHooks.inc

   INCLUDELIB     iKERNEL32.lib
   INCLUDELIB     iUSER32.lib

;------------------------------------------------------------------

.CODE

  UnhookApi   PROC  USES EBX ESI EDI, UnhStruc: PTR UNHOOK_API
    MOV       ESI, UnhStruc
    ASSUME    ESI :PTR API_UNHOOK
    MOV       EBX, [ESI].CurNoAddr
   @@:
    DEC       EBX
    JL        UnhookFin
    MOV       EDI, [ESI].WhereWhat
    MOV       EDI, (ADDR_CONTENTS PTR [EDI][EBX*SIZEOF ADDR_CONTENTS]).ReturnWhere
    PUSH      EAX
    iWin32    VirtualProtect, EDI, 4, PAGE_READWRITE, ESP
    TEST      EAX, EAX
    POP       EDX
    JE        UnhookNext 
    MOV       EAX, [ESI].WhereWhat
    MOV       EAX, (ADDR_CONTENTS PTR [EAX][EBX*SIZEOF ADDR_CONTENTS]).ReturnWhat
    MOV       [EDI], EAX
    PUSH      EAX
    iWin32    VirtualProtect, EDI, 4, EDX, ESP
    POP       EAX
   UnhookNext:
    JMP       @B
   UnhookFin:
    RET
  UnhookApi   ENDP

;------------------------------------------------------------------
  NewGetVersion    PROC     
                   INC      Counter
                   CMP      Counter, 10
                   JG       NotUnh
                   JL       @F
                   sWin32   UnhookApi, OFFSET UnhookGetVersion
                   iWin32i  MessageBox, NULL, sUnhookMsg, sUnhookTitle, MB_OK
                   JMP      @F
                  NotUnh:
                   iWin32i  MessageBox, NULL, sNotUnhookMsg, sUnhookTitle, MB_OK
                  @@:
                   iWin32j  GetVersion

                   TEXTA    GetVersion, <GetVersion/0> 

                   MkUnhook GetVersion, 3
                   Counter  DWORD 0
  NewGetVersion    ENDP

  TEXT             UnhookTitle, <Unhook/0>   
  TEXT             UnhookMsg, <Unhooked?/0>   
  TEXT             NotUnhookMsg, <Not Unhooked/:/0>   

;names-------------------------------------------------------------
                   TEXTA   KERNEL32, <KERNEL32.dll/0> 
;------------------------------------------------------------------
 BeginHooks      Unhook
     MkHook ,   , GetVersion, HOOK_IMPORT, NULL
 EndHooks
;------------------------------------------------------------------

END  

:TRANSLATE
@ECHO OFF
ML    /c /coff  /nologo UnhookDll.bat
LINK3 UnhookDll /nologo /DLL /NOENTRY /OUT:Unhook.dll /EXPORT:Unhook,@1,NONAME /SUBSYSTEM:WINDOWS /MERGE:.idata=.text /MERGE:.rdata=.text /SECTION:.text,WRE /IGNORE:4078 /BASE:0X77300000
DEL   UnhookDll.obj
DEL   Unhook.exp
DEL   Unhook.lib