procedure PatchIAT(
Dll : Pchar; OldFunction :
String; newFunc : Pointer);
var
image : LoadedImage;
pImageImportDir : PIMAGEIMPORTDESCRIPTOR;
last : PImageSectionHEader;
size : Cardinal;
dllname : Pchar;
pThunk : PImageThunkData;
lTrue : Boolean;
written : Cardinal;
pByName : pImageImportByName;
begin
MapAndLoad(Pchar(ParamStr(0)),
nil,@image,True,True);
pImageImportDir := ImageDirectoryEntryToData(
image.MappedAddress
,False
,IMAGE_DIRECTORY_ENTRY_IMPORT
,size);
while pImageImportDir.NameOffset <> 0
Do begin
dllname := ImageRVAToVA(image.FileHeader,image.MappedAddress,pImageImportDir.NameOffset,last);
If (lstrcmpiA(dllname ,
Dll) = 0)
Then begin
Showmessage('
DLL GEFUNDEN');
pThunk := ImageRVAToVA(image.FileHeader,image.MappedAddress,pImageImportDir.IATOffset,last);
While pThunk^.FunctionPtr <>
nil Do begin
pbyName := ImageRVAtoVA(image.FileHeader,image.MappedAddress,Cardinal(pThunk^.AddressOfData),last);;
//Showmessage(pbyname.Name);
IF pbyName.
Name = OldFunction
Then begin
Showmessage('
FUNKTION GEFUNDEN');
VirtualProtectEx(GetCurrentProcess,pThunk^.FunctionPtr,4,PAGE_EXECUTE_READWRITE,written);
WriteProcessMemory(GetCurrentProcess, pThunk^.FunctionPtr, Addr(newFunc), sizeof(newFunc), Written);
{pThunk^.FunctionPtr := newFunc;}
end;
Inc(Pthunk);
end;
end;
Inc(pImageImportDir);
end;
UnmapAndLoad(@image);
end;
function newMessageBoxA(hWnd: HWND; lpText, lpCaption: PAnsiChar; uType: UINT): Integer;
stdcall;
begin
Form1.Button1.Caption := '
NO MSGBOX!';
end;
procedure TForm1.Button1Click(Sender: TObject);
begin
PatchIAT('
user32.dll','
MessageBoxA',@newMessageBoxA);
end;
procedure TForm1.Button2Click(Sender: TObject);
begin
MessageBoxA(0,'
DD','
DD',0);
end;