#include <windows.h>// 假設這兩個函數是存在的
void DoRD() {}
void 改堆棧cal1() {}
void 改回堆棧cal1() {}__declspec(naked) void HOOKcall()
{__asm{pushadnop}__asm{popadmov eax, dword ptr [esi + 8]sub eax, ecxretn}
}int main() {// 第一個 Hook 操作DWORD HookAddress1 = 0x00491C62;//原函數地址DWORD HookSubroutinePtr1 = (DWORD)HOOKcall;//跳轉函數地址DWORD JumpValue1 = HookSubroutinePtr1 - HookAddress1 - 5;DWORD old1 = 0;// 修改頁面屬性為可執行、可讀、可寫VirtualProtect((PVOID)HookAddress1, 114, PAGE_EXECUTE_READWRITE, &old1);// 修改內存*(BYTE*)HookAddress1 = 0xE8;//先寫第一個B, 0xE8=Call*(DWORD*)(HookAddress1 + 1) = JumpValue1;//HookAddress1后面4個字節填寫跳轉值*(BYTE*)(HookAddress1 + 5) = 0x90;//空余的一個B用NOP填充// 恢復頁面屬性VirtualProtect((PVOID)HookAddress1, 114, old1, &old1);// 第二個 Hook 操作DWORD HookAddress2 = 0x00492008;DWORD HookSubroutinePtr2 = (DWORD)改回堆棧cal1;DWORD JumpValue2 = HookSubroutinePtr2 - HookAddress2 - 5;DWORD old2 = 0;// 修改頁面屬性為可執行、可讀、可寫VirtualProtect((PVOID)HookAddress2, 114, PAGE_EXECUTE_READWRITE, &old2);// 修改內存*(BYTE*)HookAddress2 = 0xE9;*(DWORD*)(HookAddress2 + 1) = JumpValue2;*(BYTE*)(HookAddress2 + 5) = 0x90;// 恢復頁面屬性VirtualProtect((PVOID)HookAddress2, 114, old2, &old2);return 0;
}    

DbgView輸出調試信息

#include <stdio.h>
#include <stdarg.h>
#include <windows.h>void CallOutputDebugInfo(char* pszFormat, ...) {
#ifdef DEBUGchar szbufFormat[0x1000];char szbufFormat_Game[0x1100] = "";va_list argList;// 參數列表初始化va_start(argList, pszFormat);// 使用 vsprintf_s 格式化字符串vsprintf_s(szbufFormat, sizeof(szbufFormat), pszFormat, argList);// 拼接字符串strcat_s(szbufFormat_Game, sizeof(szbufFormat_Game), szbufFormat);// 輸出調試信息OutputDebugStringA(szbufFormat_Game);// 結束可變參數列表的使用va_end(argList);
#endif
}    

提權

#include <windows.h>
#include <stdio.h>//OpenProcess失敗情況下的提權代碼
BOOL Call_ElevatePrivilege(BOOL bEnable) {// 初始化成功標志BOOL fOK = FALSE;HANDLE hToken;// 打開當前進程的訪問令牌if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken)) {TOKEN_PRIVILEGES tp;// 設置權限數量tp.PrivilegeCount = 1;// 查找調試權限的 LUIDLookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);// 根據傳入的參數設置權限屬性if (bEnable) {tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;} else {tp.Privileges[0].Attributes = 0;}// 調整令牌權限AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);// 檢查操作是否成功fOK = (GetLastError() == ERROR_SUCCESS);// 關閉令牌句柄CloseHandle(hToken);}return fOK;
}