微软detours库易语言演示源码

系统结构:取函数地址Ex,Call,asm_CALLSub,UnHOOK,HOOKFunc,HOOKAPI,CallFunc,LoadLibraryA,GetProcAddress,LocalSize_STARTUPINFO,NewMSGB,

======EC
           |  |
           |  |------ _启动子程序
           |  |
           |  |
======Main
           |  |
           |  |------ 取函数地址Ex
           |  |
           |  |------ Call
           |  |
           |  |------ asm_CALLSub
           |  |
           |  |
======HookLib
           |  |
           |  |------ _初始化
           |  |
           |  |------ _销毁
           |  |
           |  |------ UnHOOK
           |  |
           |  |------ HOOKFunc
           |  |
           |  |------ HOOKAPI
           |  |
           |  |------ CallFunc
           |  |
           |  |
======调用的Dll
           |  |
           |  |---[dll]------   _DetourFunction
           |  |
           |  |---[dll]------   LoadLibraryA
           |  |
           |  |---[dll]------   GetProcAddress
           |  |
           |  |---[dll]------   LocalSize_STARTUPINFO
  ======窗口程序集1
           |  |
           |  |------ __启动窗口_创建完毕
           |  |
           |  |------ __启动窗口_将被销毁
           |  |
           |  |------ _按钮1_被单击
           |  |
           |  |------ _按钮2_被单击
           |  |
           |  |------ _按钮3_被单击
           |  |
           |  |------ NewMSGB

调用的DLL命令:

.DLL命令 _DetourFunction, 整数型, "NatureA.lib", "_DetourFunction@8"
    .参数 原函数地址
    .参数 新函数地址

.DLL命令 LoadLibraryA, 整数型, "kernel32.dll", "LoadLibraryA", , 载入指定的动态链接库，并将它映射到当前进程使用的地址空间
    .参数 动态链接库名称, 文本型, , lpLibFileName,指定要载入的动态链接库的名称

.DLL命令 GetProcAddress, 整数型, "kernel32.dll", "GetProcAddress", , ,GetProcAddress 如果GetProcAddress执行成功，则返回模块中函数入口处的地址，否则返回nil。
    .参数 模块句柄, 整数型, , hModule
    .参数 函数名称, 文本型, , lpProcName

.DLL命令 LocalSize_STARTUPINFO, 整数型, "kernel32.dll", "LocalSize"
    .参数 STARTUPINFO, STARTUPINFO