[C+] - Win2K MessageBoxA 攔截

#include <vcl.h>
#include <windows.h>

#pragma hdrstop
#pragma argsused

FARPROC   fpAddress;
HMODULE hModule;
BYTE   OldCode[5], NewCode[5];
BOOL   bHook = false;

void HookOn();
void HookOff();
int WINAPI MyMessageBoxA(HWND hWnd, LPCTSTR lpText,LPCTSTR lpCaption, UINT uType);
BOOL Init();

void HookOn()
{
DWORD OldProtection;
VirtualProtect(fpAddress, 5, PAGE_READWRITE,&OldProtection);
memcpy(fpAddress, NewCode, 5);
VirtualProtect(fpAddress, 5, OldProtection, &OldProtection);
bHook=true;
}

void HookOff()
{
DWORD OldProtection;
VirtualProtect(fpAddress,5, PAGE_READWRITE, &OldProtection);
memcpy(fpAddress, OldCode, 5);
VirtualProtect(fpAddress, 5, OldProtection, &OldProtection);
bHook = false;
}

int WINAPI MyMessageBoxA(HWND hWnd, LPCTSTR lpText,LPCTSTR lpCaption, UINT uType)
{
int nReturn;
HookOff();
nReturn = MessageBoxA(hWnd, "Context", (LPCSTR)lpCaption, MB_OK | MB_ICONINFORMATION);
HookOn();
return(nReturn);
}

BOOL Init()
{
hModule = LoadLibrary(L"user32.dll");
fpAddress = GetProcAddress(hModule, "MessageBoxA");
if(fpAddress == NULL)
return false;
_asm
{
pushad
lea edi, OldCode
mov esi, fpAddress
cld
movsd
movsb
popad
}
NewCode[0] = 0xe9;
_asm
{
lea eax, MyMessageBoxA
mov ebx, fpAddress
sub eax, ebx
sub eax, 5
mov dword ptr [NewCode + 1], eax
}
HookOn();
return(true);
}