110,534
社区成员
发帖
与我相关
我的任务
分享
struct PARAMS
{
DWORD PID;
HKEY hKey;
char buffer1[1024];
int cbBuffer1;
char buffer2[1024];
int cbBuffer2;
DWORD type;
long result;
};
DETOUR_TRAMPOLINE(LONG WINAPI Real_RegSetValueExW(HKEY, LPCWSTR, DWORD, DWORD, CONST BYTE*, DWORD), RegSetValueExW);
LONG WINAPI Mine_RegSetValueExW(
HKEY hKey,
LPCWSTR lpValueName,
DWORD Reserved,
DWORD dwType,
CONST BYTE* lpData,
DWORD cbData
)
{
LONG nRet;
__try{
nRet = Real_RegSetValueExW(hKey, lpValueName, Reserved, dwType, lpData, cbData);
if(!HOOK_RegSetValueEx)
return nRet;
if(GetCurrentProcessId() == ExplorerPID)
return nRet;
if(GetCurrentProcessId() == RegMonPID)
return nRet;
if((PID == 0) || ((GetCurrentProcessId() == PID) && (PID>0)) )
{
if(lpValueName == NULL || lpData == NULL)
return nRet;
COPYDATASTRUCT data;
PARAMS params = {0};
params.PID = GetCurrentProcessId();
params.hKey = hKey;
memcpy(params.buffer1, lpValueName, wcslen(lpValueName)*2);
params.cbBuffer1=wcslen(lpValueName)*2;
params.type = dwType;
if(cbData>1024)
{
memcpy(params.buffer2, lpData, 1024);
params.cbBuffer2 = 1024;
}
else
{
memcpy(params.buffer2, lpData, cbData);
params.cbBuffer2 = cbData;
}
params.result = nRet;
data.cbData = sizeof(PARAMS);
data.lpData = ¶ms;
data.dwData = TYPE_RegSetValueExW;
SendMessage(hWnd, WM_COPYDATA, (WPARAM)hWnd, (LPARAM)&data);
}
}__finally{
};
return nRet;
}
const int WM_COPYDATA = 0x004A;
const int WM_CANCELJOURNAL = 0x004B;
public struct PARAMS
{
[MarshalAs(UnmanagedType.U4)]
public uint PID;
public IntPtr hKey; //?指针
public IntPtr buffer1;
//public string buffer1; //指针
public IntPtr cbBuffer1;
//[MarshalAs(UnmanagedType.ByValArray, SizeConst = 1024)]
public IntPtr buffer2;
//public IntPtr buffer2; //指针
public IntPtr cbBuffer2;
public IntPtr type;
public long result;
};
public struct COPYDATASTRUCT
{
public IntPtr dwData;
public int cbData;
public PARAMS lpData;
}
protected override void DefWndProc(ref Message m)
{
switch (m.Msg)
{
case WM_COPYDATA:
try
{
COPYDATASTRUCT s = new COPYDATASTRUCT();
Type t = s.GetType();
s = (COPYDATASTRUCT)m.GetLParam(t);
Console.WriteLine("s.cbData:" + s.cbData);
Console.WriteLine("s.dwData:" + s.dwData);
Console.WriteLine("hKey:" + Marshal.ReadInt32(s.lpData.hKey));
Console.WriteLine("PID:" + s.lpData.PID);
Console.WriteLine("type:" + s.lpData.type);
Console.WriteLine("cbBuffer1:" + s.lpData.cbBuffer1);
Console.WriteLine("cbBuffer2:" + s.lpData.cbBuffer2);
PARAMS p = s.lpData;
}
catch (Exception ex) { }
break;
default:
base.DefWndProc(ref m);
break;
}
}
const uint WM_COPYDATA = 0x004A;
const uint WM_CANCELJOURNAL = 0x004B;
public struct PARAMS
{
public uint PID;
public IntPtr hKey;
public StringBuider buffer1;
public int cbBuffer1;
public StringBuider buffer2;
int cbBuffer2;
public uint type;
public int result;
};
public struct COPYDATASTRUCT
{
public IntPtr dwData;
public int cbData;
public IntPtr lpData;
}
protected override void DefWndProc(ref Message m)
{
switch (m.Msg)
{
case WM_COPYDATA:
try
{
COPYDATASTRUCT s = (COPYDATASTRUCT)Marshal.PtrToStructure(m.LParam, typeof(COPYDATASTRUCT));
PARAMS p = (PARAMS)Marshal.PtrToStructure(s.lpData, typeof(PARAMS));
Console.WriteLine("s.cbData:" + s.cbData.ToInt32());
Console.WriteLine("s.dwData:" + s.dwData);
Console.WriteLine("hKey:" + p.hKey.ToInt32());
Console.WriteLine("PID:" + p.PID);
Console.WriteLine("type:" + p.type);
Console.WriteLine("cbBuffer1:" + p.cbBuffer1.ToString());
Console.WriteLine("cbBuffer2:" + p.cbBuffer2.ToString());
}
catch (Exception ex) { }
break;
default:
base.DefWndProc(ref m);
break;
}
}
[StructLayout(LayoutKind.Sequential)]
private struct PARAMS
{
uint PID;
int hKey;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 1024)]
byte[] buffer1;
int cbBuffer1;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 1024)]
char[] buffer2;
int cbBuffer2;
uint type;
int result;
}