因为在那之后,我又更新了一下Thread.au3,使得部分函数不能兼容以前的代码。用以下这个测试:
#include <Thread.au3>
Const $tagSET_SKIN = "hWnd hWnd;wchar LicenKey[8];wchar SkinPath[520]"
$sImagePath = @ScriptDir & "\SkinCrafterDll.dll"
$sFilePath = @ScriptDir & "\Sequence.skf"
$pLibrary = _RTLoadLibrary($sImagePath)
Const $pApplySkin = _RTGetProcAddress($pLibrary, "ApplySkin")
Const $pDecorateAs = _RTGetProcAddress($pLibrary, "DecorateAs")
Const $pLoadSkinFromFile = _RTGetProcAddress($pLibrary, "LoadSkinFromFile")
Const $pInitDecoration = _RTGetProcAddress($pLibrary, "InitDecoration")
Const $pInitLicenKeys = _RTGetProcAddress($pLibrary, "InitLicenKeys")
_RTFreeLibrary($pLibrary)
Run(@SystemDir & "\notepad.exe")
ProcessWait("notepad.exe")
Sleep(700)
$hWnd = WinGetHandle("[class:Notepad]")
$iProcessId = _RTGetWindowThreadProcessId($hWnd)
$iThreadId = @Extended
$hProcess = _RTOpenProcess($iProcessId)
$hThread = _RTOpenThread($iThreadId)
$pStartAddr = _RTVirtualAllocEx($hProcess, 2048)
$pParam = $pStartAddr + 512
_RTWriteProcessMemory($hProcess, $pParam, $hWnd, 4, "hWnd*")
_RTWriteProcessMemory($hProcess, $pParam + 4, 1, 6, "wstr")
_RTWriteProcessMemory($hProcess, $pParam + 20, $sFilePath, 518, "wstr")
_RTInfiltrateThread($hProcess, $hThread, $pStartAddr, 0, $pParam)
$bCode = "0x" & _
"55" & _ ; push ebp
"8BEC" & _ ; mov ebp, esp
"60" & _ ; pushad
"8B5D08" & _ ; mov ebx, dword ptr [ebp+8]
"8D7B04" & _ ; lea edi, dword ptr [ebx+4]
"57" & _ ; push edi
"57" & _ ; push edi
"6A00" & _ ; push 0
"57" & _ ; push edi
"B8" & _RTLongPtrToBytes($pInitLicenKeys) & _ ; mov eax, InitLicenKeys
"FFD0" & _ ; call eax
"6A01" & _ ; push 1
"B8" & _RTLongPtrToBytes($pInitDecoration) & _ ; mov eax, InitDecoration
"FFD0" & _ ; call eax
"8D7B14" & _ ; lea edi, dword ptr [ebx+14]
"57" & _ ; push edi
"B8" & _RTLongPtrToBytes($pLoadSkinFromFile) & _ ; mov eax, LoadSkinFromFile
"FFD0" & _ ; call eax
"6A19" & _ ; push 19
"FF33" & _ ; push dword ptr [ebx]
"B8" & _RTLongPtrToBytes($pDecorateAs) & _ ; mov eax, DecorateAs
"FFD0" & _ ; call eax
"B8" & _RTLongPtrToBytes($pApplySkin) & _ ; mov eax, ApplySkin
"FFD0" & _ ; call eax
"83C420" & _ ; add esp, 20
"61" & _ ; popad
"5D" & _ ; pop ebp
"C20400" ; ret 4
_RTLoadDllEx($sImagePath, $hProcess)
_RTInjectEx($hProcess, $pStartAddr, $bCode)
_RTResumeThread($hThread)
_RTCloseHandle($hThread)
_RTCloseHandle($hProcess)
注意把$sImagePath和$sFilePath改成你自己的DLL文件和皮肤文件的全路径。 |