一段劫持d2realm的代码.汗delphi
unit D2Realm;
interface
uses
Windows;
const
OnSendRealmPacket :function (aPacket:PByte; aLen:DWORD):DWORD stdcall=nil;
OnReceiveRealmPacket:function (aPacket:PByte; aLen:DWORD):DWORD stdcall=nil;
procedure RealmSetPatch;
procedure RealmUnsetPatch;
procedure RealmSendPacket(aPacket:PByte; aLen:DWORD); stdcall;
procedure RealmSendCommand(Command:String);
implementation
type
TCodeData=Array[1..6] of Byte;
const
dOnSendRealmPacket :DWORD=$6FF135FE;
dOnReceiveRealmpacket:DWORD=$6FF0214A;
var
daOnSendRealmPacket,
daOnReceiveRealmpacket:DWORD;
ocOnSendRealmPacket,
ocOnReceiveRealmpacket:TCodeData;
procedure SetCode(pos:DWORD; aBuff:Pointer; aLen, size:DWORD);
var
hp, oldp: DWORD;
newcode:TCodeData;
i:DWORD;
begin
hp:=OpenProcess(PROCESS_ALL_ACCESS, false, GetCurrentProcessID);
VirtualProtectEx(hp, Ptr(pos), size, PAGE_EXECUTE_READWRITE, oldp);
Move(PTR(pos)^, newcode, aLen);
Move(aBuff^, PTR(pos)^, aLen);
Move(newcode, aBuff^, aLen);
for i:=pos+aLen to pos+size-1 do PByte(i)^:=$90;
CloseHandle(hp);
end;
procedure SetJmpPatch(dPos:DWORD; daPos:Pointer; size:DWORD; var oldcode:TCodeData);
const
JmpCode:TCodeData=($FF,$25,$00,$00,$00,$00);
begin
oldcode:=JmpCode;
Move(daPos, oldCode[3], 4);
SetCode(dPos, @oldCode, 6, size);
end;
//
procedure asmOnSendRealmPacket;
asm
MOV EAX, OnSendRealmPacket
CMP EAX, 0
JZ @BACK
PUSHAD
PUSH [ESP+$24]
PUSH EDX
CALL EAX
MOV [ESP+$24], EAX
POPAD
@BACK:
JMP [$6FF1604C]
end;
var
_Data1:DWORD;
procedure asmOnReceiveRealmPacket;
const
dBack1:DWORD=$6FF02150;
dBack2:DWORD=$6FF021D1;
asm
MOV EDX, OnReceiveRealmPacket
CMP EDX, 0
JZ @BACK
LEA ECX, [ESP+$2014]
PUSHAD
PUSH EAX
PUSH ECX
CALL EDX
MOV DWORD PTR _DATA1, EAX
POPAD
MOV EAX, DWORD PTR _DATA1
@BACK:
TEST EAX, EAX
JLE @BACK2
JMP [dBack1]
@BACK2:
JMP [dBack2]
end;
procedure RealmSendPacket(aPacket:PByte; aLen:DWORD); stdcall;
asm
MOV ECX, [$6FF1D158]
MOV EDX, aPacket
PUSH aLen
CALL dOnSendRealmPacket
end;
procedure RealmSendCommand(Command:String);
begin
Command:=#$FF#$0E+Chr(Length(Command)+5)+#$00+Command+#$00;
RealmSendPacket(@Command[1], Length(Command));
end;
//
procedure RealmSetPatch;
begin
SetJmpPatch(dOnSendRealmPacket , @daOnSendRealmPacket , 6, ocOnSendRealmPacket );
SetJmpPatch(dOnReceiveRealmpacket, @daOnReceiveRealmpacket, 6, ocOnReceiveRealmpacket);
end;
procedure RealmUnsetPatch;
begin
SetCode(dOnSendRealmPacket , @ocOnSendRealmPacket , 6, 6);
SetCode(dOnReceiveRealmpacket, @ocOnReceiveRealmpacket, 6, 6);
end;
begin
daOnSendRealmPacket :=DWORD(@asmOnSendRealmPacket );
daOnReceiveRealmpacket:=DWORD(@asmOnReceiveRealmpacket);
end.
