C / C++ / MFC

11-Mar-06 15:15

i want to hook the dll funtion, my mothod is modification the exe Import Table.

have other method of hook dll and not need modification the Import Table and Export Table.

thanks.

Anton Mikhalyov11-Mar-06 18:17

11-Mar-06 18:17

HOW WHAT wrote:
have other method of hook dll and not need modification the Import Table and Export Table.

you can change first bytes of function to far jmp that points on your code.

HOW WHAT11-Mar-06 18:41

11-Mar-06 18:41

how to ? ex.?

Anton Mikhalyov11-Mar-06 20:52

11-Mar-06 20:52

This example shows the hook of GetModuleHandleW in target process(process where you injected your dll). It works only in 32-bit windows.
If you injected your dll into multithreaded process you must synchronize execution of this code with other threads or program sometimes may crash.

<br />
#define BYTES_COUNT 0x05<br />
<br />
BYTE firstBytes[BYTES_COUNT];<br />
void *pfnGetModuleHandle;<br />
HANDLE __stdcall Handler(HANDLE hModule);<br />
<br />
// Only running process hook<br />
BOOL HookGetModuleHandle()<br />
{<br />
	HANDLE hKernel32;<br />
	DWORD dwOldProtect;<br />
<br />
	hKernel32 = LoadLibrary(_T("kernel32.dll"));<br />
	pfnGetModuleHandle = GetProcAddress((HMODULE)hKernel32, "GetModuleHandleW");<br />
<br />
	if (hKernel32 == NULL || pfnGetModuleHandle == NULL)<br />
	{<br />
		return FALSE;<br />
	}<br />
<br />
	memcpy(&firstBytes, pfnGetModuleHandle, BYTES_COUNT);<br />
<br />
	if (!VirtualProtect(pfnGetModuleHandle, BYTES_COUNT, PAGE_READWRITE, &dwOldProtect))<br />
	{<br />
		return FALSE;<br />
	}<br />
<br />
	*((BYTE*)pfnGetModuleHandle) = 0xE9;<br />
	*((DWORD*)(((BYTE*)pfnGetModuleHandle)+1)) = (DWORD)Handler - (DWORD)pfnGetModuleHandle - BYTES_COUNT;<br />
<br />
	if (!VirtualProtect(pfnGetModuleHandle, BYTES_COUNT, dwOldProtect, NULL))<br />
	{<br />
		return FALSE;<br />
	}<br />
<br />
	return TRUE;<br />
}<br />
<br />
BOOL UnhookGetModuleHandle()<br />
{<br />
	DWORD dwOldProtect;<br />
<br />
	if (!VirtualProtect(pfnGetModuleHandle, BYTES_COUNT, PAGE_READWRITE, &dwOldProtect))<br />
	{<br />
		return FALSE;<br />
	}<br />
<br />
	memcpy(pfnGetModuleHandle, &firstBytes, BYTES_COUNT);<br />
<br />
	if (!VirtualProtect(pfnGetModuleHandle, BYTES_COUNT, dwOldProtect, NULL))<br />
	{<br />
		return FALSE;<br />
	}<br />
<br />
	return TRUE;<br />
}<br />
<br />
HANDLE __stdcall Handler(HANDLE hModule)<br />
{<br />
	HANDLE returned;<br />
	printf("GetModuleHandleW call detected\n");<br />
	UnhookGetModuleHandle();<br />
	__asm {<br />
		push hModule<br />
		call pfnGetModuleHandle<br />
		mov returned, eax<br />
	}<br />
	HookGetModuleHandle();<br />
}<br />

HOW WHAT12-Mar-06 1:24

12-Mar-06 1:24

your method and modification the Import Table, which will be highness and safe?

Anton Mikhalyov12-Mar-06 3:55

12-Mar-06 3:55

My method is better to use, because it never fail, except when application detected and removed hook(very very rarely), but it creates additional problems with synchronization in mt applications and it doesn't work on windows other than 32 bit(without modification).
IAT modification is also good method, but this hook wouldn't work if application directly calls functions(call GetProcAddress to retrieve address of function...). Second method fails more offen than first.
Also you can create a dll that debugs process in which it injected by inserting int3 instructions into functions you want to hook. If number of functions to hook =< 4 you can use hardware breakpoints, setting hardware breakpoints do not require any code modifications.

HOW WHAT12-Mar-06 4:52

12-Mar-06 4:52

1.Your method if had some call hooked function may be happen some exception, right?

2.How to do like you say
"Also you can create a dll that debugs process in which it injected by inserting int3 instructions into functions you want to hook. If number of functions to hook =< 4 you can use hardware breakpoints, setting hardware breakpoints do not require any code modifications. "

Some time ago, I download codeproject about use debug process to inject dll, but in win98 all application will happen crash.

Anton Mikhalyov13-Mar-06 1:17

13-Mar-06 1:17

HOW WHAT wrote:
1.Your method if had some call hooked function may be happen some exception, right?

Only when application threads are not synchronized and context of current thread(that now hooking function) is switched to other that calls hooked function.

HOW WHAT wrote:
2. How to do like you say

There is an error in code you just downloaded.
Armadillo protector uses the same technique and it works best on Windows 9x\Me
Give me the URL of this example or send it to my mail - sharebyte gmail com

ALTER TABLE

The Little Lloyd11-Mar-06 11:11

The Little Lloyd

11-Mar-06 11:11

Hello all!
Problem: I am using SQL frm within my C++ code.
Can anyone tell me HOW to change a name of a column of a table (for a MS Access 2000 database)?

Using "ALTER TABLE table_name RENAME COLUMN old_name TO new_name" seems not to work because of syntax failure !

Thanks

Jeremy Falcon11-Mar-06 15:12

Jeremy Falcon

11-Mar-06 15:12

What's the exact query you're using?

Jeremy Falcon

The Little Lloyd11-Mar-06 19:43

The Little Lloyd

11-Mar-06 19:43

The table is: Cars
The column I want to rename: Colour (of type CHARACTER VARYING(255))

ALTER TABLE Cars RENAME COLUMN Colour TO FormerColour CHARACTER VARYING(255)

Thanks

-- modified at 1:44 Sunday 12th March, 2006

Jeremy Falcon11-Mar-06 20:07

Jeremy Falcon

11-Mar-06 20:07

You don't need the the type of the column to rename it. This should do the job...

ALTER TABLE Cars RENAME COLUMN Colour TO FormerColour;

Also, CHARACTER VARYING is just a synonym for TEXT if you'd rather use that to keep your queries smaller.

Jeremy Falcon

The Little Lloyd11-Mar-06 20:52

The Little Lloyd

11-Mar-06 20:52

I've already done that. I still get an sql syntax error. It simply does not work Frown | :-(

with (my) access 2000. Other idea?

Jeremy Falcon12-Mar-06 11:19

Jeremy Falcon

12-Mar-06 11:19

Did you try running it specifically as a DDL query (under the Query/SQL Specific menu)?

If that still doesn't work, then I'm so glad I don't have to use Access anymore. Smile | :)

However, if you must use Access then you could always rename the column using ADOX rather than a SQL statement. Or if all else fails, you could still pull off the same thing by using separate queries like this...

ALTER TABLE Table1 ADD COLUMN New_Col TEXT(255);
UPDATE Table1 SET New_Col = Old_Col;
ALTER TABLE Table1 DROP COLUMN Old_Col;

Jeremy Falcon

Bold text

yaaqub11-Mar-06 10:22

yaaqub

11-Mar-06 10:22

HI,
I want my inputs to be BOLD TEXT.

JOHN,K

C^hris L^osinger11-Mar-06 10:37

C^hris L^osinger

11-Mar-06 10:37

ok

Cleek | Image Toolkits | Thumbnail maker

John R. Shaw11-Mar-06 22:55

John R. Shaw

11-Mar-06 22:55

I am still laughing, at least I told him not to post that again.

INTP
Every thing is relative...

Jörgen Sigvardsson11-Mar-06 11:02

Jörgen Sigvardsson

11-Mar-06 11:02

Create a bold font, and pass it to edit box's SetFont() method...

Hamid_RT11-Mar-06 17:17

Hamid_RT

11-Mar-06 17:17

use Createfont
http://msdn2.microsoft.com/en-us/library/2ek64h34.aspx[^]

Jörgen Sigvardsson11-Mar-06 22:18

Jörgen Sigvardsson

11-Mar-06 22:18

Why are you telling me this?