KeyboardLayout einer fremden Anwendung ändern

[Zacherl]

Folgendermaßen ist jetzt mein Ansatz: Dieser funktioniert, wenn der Zielprozess schon einige Zeit aktiv war. Bei Verwendung von CREATE_SUSPENDED im CreateProcess() schmiert die Zielanwendung nach meinem Hijack allerdings sofort ab.

Delphi-Quellcode:

function W32HijackThread(hProcess, hThread: Cardinal; Code: Pointer;
  CodeLen: DWord): Boolean;
var
  lpRoutine: Pointer;
  dwWritten: DWord;
  lpNewContext: TContext;
  ASMStub: Array[0..4] of Byte;
begin
  Result := false;
  SuspendThread(hThread);
  try
    FillChar(lpNewContext, SizeOf(TContext), #0);
    lpNewContext.ContextFlags := CONTEXT_CONTROL;
    if not GetThreadContext(hThread, lpNewContext) then
      Exit;
    lpRoutine := VirtualAllocEx(hProcess, nil, CodeLen + 5, MEM_COMMIT,
      PAGE_EXECUTE_READWRITE);
    if not Assigned(lpRoutine) then
      Exit;
    ASMStub[0] := $68;
    CopyMemory(@ASMStub[1], @lpNewContext.Eip, 4);
    if not WriteProcessMemory(hProcess, lpRoutine, @AsmStub[0], 5,
      dwWritten) then
      Exit;
    if not WriteProcessMemory(hProcess, Pointer(Cardinal(lpRoutine) + 5), Code,
      CodeLen, dwWritten) then
      Exit;
    lpNewContext.Eip := DWord(lpRoutine);
    Result := SetThreadContext(hThread, lpNewContext);
  finally
    ResumeThread(hThread);
  end;
end;

Delphi-Quellcode:

procedure HijackProc; assembler;
asm
  pusha
  nop
  push dword ptr 129
  push dword ptr $FFFFFFFF
  mov eax, $FFFFFFFF
  //call eax
  popa
end;
procedure HijackProcEnd; begin end;

const
  LANGUAGEID: PAnsiChar = '00000409' + #0;

var
  dwHijackSize,
  dwOldProtect,
  dwAddress,
  dwWritten: DWord;
  lpLang: Pointer;
  lpProcessInfo: TProcessInformation;
  lpStartupInfo: TStartupInfo;
begin
  FillChar(lpStartupInfo, SizeOf(TStartupInfo), #0);
  if CreateProcess('C:\Program Files (x86)\Subagames\CrossFire\crossfire.exe', nil, nil, nil, false, CREATE_SUSPENDED,
    nil, nil, lpStartupInfo, lpProcessInfo) then
  begin
    W32InjectModule('user32.dll', lpProcessInfo.hProcess);
    lpLang := VirtualAllocEx(lpProcessInfo.hProcess, nil, 9, MEM_COMMIT,
      PAGE_EXECUTE_READWRITE);
    if Assigned(lpLang) and WriteProcessMemory(lpProcessInfo.hProcess, lpLang,
      LANGUAGEID, 9, dwWritten) then
    begin
      dwHijackSize := Cardinal(@HijackProcEnd) - Cardinal(@HijackProc);
      if VirtualProtect(@HijackProc, dwHijackSize, PAGE_EXECUTE_READWRITE,
        dwOldProtect) then
      begin
        dwAddress := DWord(lpLang);
        CopyMemory(Pointer(Cardinal(@HijackProc) + 9), @dwAddress, 4);
        dwAddress := DWord(GetProcAddress(LoadLibrary('user32.dll'),
          'LoadKeyboardLayoutA'));
        CopyMemory(Pointer(Cardinal(@HijackProc) + 14), @dwAddress, 4);
        W32HijackThread(lpProcessInfo.hProcess, lpProcessInfo.hThread,
          @HijackProc, dwHijackSize);
      end;
    end;   
    ResumeThread(lpProcessInfo.hThread);
  end;
end;

Hat jemand ne Idee, woran das liegen könnte?

Gruß Zacherl