[DllImport("kernel32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
[DllImport("kernel32.dll")]
public static extern IntPtr LoadLibrary(string name);
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern IntPtr GetModuleHandle(string lpModuleName);
[DllImport("kernel32")]
public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
[DllImport("kernel32.dll", EntryPoint = "RtlMoveMemory", SetLastError = false)]
public static extern void MoveMemory(object dest, object src, int size);
private IntPtr m_pFunc;
private byte[] m_OriginBytes = new byte[6];
private byte[] m_HookBytes = new byte[6];
private bool m_bFlag;
private bool Hook()
{
byte[] TmpBytes = new byte[6];
IntPtr p;
uint OriginProtect;
bool bRet = false;
m_pFunc = GetProcAddress(GetModuleHandle("user32.dll"), "MessageBoxA");
if (VirtualProtect(m_pFunc, (UIntPtr)6, 0x40, out OriginProtect))
{
unsafe
{
fixed (byte* pb = TmpBytes)
{
MoveMemory(*pb, m_pFunc, 6); // 查看TmpBytes数组，里面并没有任何东西。
}
}
bRet = true;
}
return bRet ;
}
