procptrmodule.bas

一个非常小的程序

Attribute VB_Name = "ProcPtrModule"
Option Explicit

Public Declare Function WriteProcessMemory Lib "kernel32.dll" (ByVal hProcess As Long, ByRef lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long
Public Declare Sub DebugBreak Lib "kernel32.dll" ()
Public Declare Sub CopyMemory Lib "kernel32.dll" Alias "RtlMoveMemory" (ByRef Destination As Any, ByRef Source As Any, ByVal Length As Long)

Public Function SetProcPtr(ByVal FuncAddr As Long, ByVal JmpAddr As Long) As Long
    Dim CurrentProcess As Long: CurrentProcess = &HFFFFFFFF
    Dim JmpAsmCode(8) As Byte
    Dim nSize As Long
    Dim Ret As Long
    
    JmpAsmCode(0) = &HB8
    CopyMemory JmpAsmCode(1), JmpAddr, 4
    JmpAsmCode(5) = &HFF
    JmpAsmCode(6) = &HE0
    JmpAsmCode(7) = &HCC
    JmpAsmCode(8) = &HC3
    
    Ret = WriteProcessMemory(CurrentProcess, ByVal FuncAddr, JmpAsmCode(0), 9, nSize)
    
    SetProcPtr = Ret
End Function