???????′?????MessageBox????y?????????????????????庯??MyMessageBox?????

????g_addr????洢??????MessageBox????

Typedef int (WINAPI??*PFNMESSAGEBOX(HWND??LPSTR??LPSTR??UINT);//???庯?????

 PFNMESSAGEBOX g_addr=(PFNMESSAGEBOX)MessageBoxA;//?洢MessageBoxA??????

//???????????

int WINAPI MyMessage(HWND hWnd??LPSTR a??LPSTR b??UINT type)

{

     return ((PFNMESSAGEBOX)g_addr)(hWnd??a??"?滻?????????"??MB_YESNO);

}

//?? MessageBox???????????MyMessageBox?????滻??

Void ReplaceOneFunc(PCSTR ModuleName??PFNMESSAGEBOX pfnOld??PFNMESSAGEBOX pfnNew)

{

     pfnOld=(PFNMESSAGEBOX)MessageBoxA;

     pfnNew=(PFNMESSAGEBOX)MyMessageBox;

     HMODULE hModule=GetModuleHandle(NULL);

     ULONG size;

     PIMAGE_IMPORT_DESCRIPTOR pImport=(PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData

                                                                      (hModule??true??IMAGE_DIRECTORY_ENTRY_IMPORT??&size);

     UpdateData();

     while(pImport->FirstThunk)

     {

        char *ModuleName=(char*)((BYTE*)hModule+pImport->Name);

        PIMAGE_THUNK_DATA pThunk=(PIMAGE_THUNK_DATA)((BYTE*)hModule+pImport->FirstThunk);

        while(pThunk->u1.Function)

        {

          PFNMESSAGEBOX *ppfn=(PFNMESSAGEBOX*)&(pThunk->u1.Function);

          if(*ppfn==pfnOld)

          {

             MessageBox("??????????????");

             SIZE_T num;

             WriteProcessMemory(GetCurrentProcess()??ppfn??&pfnNew??4??&num);

             MessageBox(NULL??"???????????滻???API!"??""??MB_OK);

             ((PFNMESSAGEBOX)g_addr)(NULL??"?????????????????????"??""??MB_OK);

            return ;

         }

        pThunk++;

      }

    pImport++;

    }

    MessageBox("???????ú???!");

 }
 


????WriteProcessMemory(GetCurrentProcess()??ppfn??&pfnNew??4??&num);

??????????????????檔?????MyMessagebox?????滻MessageBox?????????????????????ο?MSDN??

????((PFNMESSAGEBOX)g_addr)(NULL??"?????????????????????"??""??MB_OK);

??????????????????????MessageBox????????????????????MessageBox????????????MyMessageBox??????

??????????????????????API????????