exe.cpp

Hying s PE-Armor v0.46x

//---------------------------------------------------------------------------
#include <vcl.h>
#include  <shellapi.h>
//#include  <winuser.h>

#pragma hdrstop

#include "main.h"


//---------------------------------------------------------------------------
#pragma package(smart_init)
#pragma link "Wordcap"
#pragma resource "*.dfm"
TForm1 *Form1;

char Now_path[100];
HINSTANCE           DLLH;
HANDLE	            VXD_HANDLE;
DWORD               hook_api_addr1,hook_api_addr2,hook_api_addr3;
DWORD               out_eip;
DWORD               MessageBox_addr;


//---------------------------------------------------------------------------
__fastcall TForm1::TForm1(TComponent* Owner)
        : TForm(Owner)
{
   GetCurrentDirectory(100,Now_path);
}
//---------------------------------------------------------------------------

void __fastcall TForm1::Track_ButtonClick(TObject *Sender)
{

#define SET_BP_CODE    1
#define CLEAR_BP_CODE  2
#define ENTER_EIP_CODE 3
#define SET_SUSPEND_CODE  4


    SetWindowPos (Form1->Handle, HWND_TOPMOST, 0, 0, 0, 0, SWP_NOACTIVATE | SWP_SHOWWINDOW | SWP_NOMOVE | SWP_NOSIZE);

    /*使 窗 口 取 消 Always On Top功 能 ， 用
    SetWindowPos hWnd, HWND_NOTOPMOST, 0, 0, 0, 0, _
     SWP_NOACTIVATE Or SWP_SHOWWINDOW Or SWP_NOMOVE _
    Or SWP_NOSIZE*/



DLLH = GetModuleHandle("Kernel32.dll");
hook_api_addr1=(unsigned long) GetProcAddress(DLLH,"GetVersion");
hook_api_addr2=(unsigned long) GetProcAddress(DLLH,"GetModuleHandleA");
hook_api_addr3=(unsigned long) GetProcAddress(DLLH,"GetCommandLineA");


VXD_HANDLE=CreateFile(
  		"\\\\.\\bw2k.vxd",
   		0xC0000000,             //GENERIC_READ|GENERIC_WRITE,
   		3,                      //FILE_SHARE_READ|FILE_SHARE_WRITE,
   		0,
   		3,                      //OPEN_EXISTING,
   		0x4000000,              //FILE_FLAG_DELETE_ON_CLOSE,
   		0);

if (VXD_HANDLE!=INVALID_HANDLE_VALUE)
        {

          	DeviceIoControl(
		        VXD_HANDLE,
			SET_BP_CODE,      //服务编号 set api hook
			&hook_api_addr1,
			12,
			NULL,
			NULL,
			NULL,
			NULL);
        Track_Button->Enabled=false;
        Stop_Button->Enabled=true;

       }
else
        ShowMessage("Open  VXD Error! ");
}

//---------------------------------------------------------------------------

void __fastcall TForm1::Timer1Timer(TObject *Sender)
{
     	DeviceIoControl(
		        VXD_HANDLE,
			ENTER_EIP_CODE,    //服务编号
			&hook_api_addr1,
			12,
			&out_eip,
			4,
			NULL,
			NULL);
        EIP_Edit->Text=IntToHex((int)out_eip,8);

}
//---------------------------------------------------------------------------

void __fastcall TForm1::Stop_ButtonClick(TObject *Sender)
{
     	DeviceIoControl(
		        VXD_HANDLE,
			CLEAR_BP_CODE,    //服务编号
			&hook_api_addr1,
			12,
			NULL,
			NULL,
			NULL,
			NULL);
	CloseHandle(VXD_HANDLE);
        Track_Button->Enabled=true;
        Stop_Button->Enabled=false;

}
//---------------------------------------------------------------------------
void __fastcall TForm1::Exit_ButtonClick(TObject *Sender)
{
     this->Close();
}
//---------------------------------------------------------------------------

void __fastcall TForm1::FormClose(TObject *Sender, TCloseAction &Action)
{
     VirtualFree ((LPVOID)0xbcde0000,0x1024,MEM_DECOMMIT);
     VirtualFree ((LPVOID)0xbcde0000,0,MEM_RELEASE);

     if (Stop_Button->Enabled==true)
       {
          DeviceIoControl(
		        VXD_HANDLE,
			CLEAR_BP_CODE,    //服务编号
			&hook_api_addr1,
			12,
			NULL,
			NULL,
			NULL,
			NULL);
        }

      CloseHandle(VXD_HANDLE);

}
//---------------------------------------------------------------------------



//---------------------------------------------------------------------------