记逆向小白的第一次vbsedit 9爆破及内存补丁制作过程

#include <windows.h>
#include <stdio.h>
 
// 导出函数
#pragma comment(linker, "/EXPORT:GetFileVersionInfoA=c:\\windows\\system32\\version.dll.GetFileVersionInfoA,@1")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoByHandle=c:\\windows\\system32\\version.dll.GetFileVersionInfoByHandle,@2")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoExA=c:\\windows\\system32\\version.dll.GetFileVersionInfoExA,@3")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoExW=c:\\windows\\system32\\version.dll.GetFileVersionInfoExW,@4")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeA=c:\\windows\\system32\\version.dll.GetFileVersionInfoSizeA,@5")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeExA=c:\\windows\\system32\\version.dll.GetFileVersionInfoSizeExA,@6")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeExW=c:\\windows\\system32\\version.dll.GetFileVersionInfoSizeExW,@7")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeW=c:\\windows\\system32\\version.dll.GetFileVersionInfoSizeW,@8")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoW=c:\\windows\\system32\\version.dll.GetFileVersionInfoW,@9")
#pragma comment(linker, "/EXPORT:VerFindFileA=c:\\windows\\system32\\version.dll.VerFindFileA,@10")
#pragma comment(linker, "/EXPORT:VerFindFileW=c:\\windows\\system32\\version.dll.VerFindFileW,@11")
#pragma comment(linker, "/EXPORT:VerInstallFileA=c:\\windows\\system32\\version.dll.VerInstallFileA,@12")
#pragma comment(linker, "/EXPORT:VerInstallFileW=c:\\windows\\system32\\version.dll.VerInstallFileW,@13")
#pragma comment(linker, "/EXPORT:VerLanguageNameA=c:\\windows\\system32\\version.dll.VerLanguageNameA,@14")
#pragma comment(linker, "/EXPORT:VerLanguageNameW=c:\\windows\\system32\\version.dll.VerLanguageNameW,@15")
#pragma comment(linker, "/EXPORT:VerQueryValueA=c:\\windows\\system32\\version.dll.VerQueryValueA,@16")
#pragma comment(linker, "/EXPORT:VerQueryValueW=c:\\windows\\system32\\version.dll.VerQueryValueW,@17")
 
 
//宏 Debug("fORMat string",arg1,arg2,...)
//用于Debug调试信息输出，用法同 printf
#ifdef _DEBUG
#define Debug(...) DllPrintf(__VA_ARGS__) 
#else
#define Debug(...) 
#endif
 
int DllPrintf(char *fmt,...)
{
	//dll调试时打开控制台窗口显示调试信息
	//用法同printf
 
	va_list argptr;
	va_start(argptr,fmt);
	char buffer[512] ={0};
	int cnt = vsprintf_s(buffer,fmt,argptr);
	va_end(argptr);
 
	static HANDLE ghConsole = INVALID_HANDLE_VALUE;
	if(INVALID_HANDLE_VALUE == ghConsole)
	{
		AllocConsole();
		ghConsole = GetStdHandle(STD_OUTPUT_HANDLE);
	}
	DWORD dw;
	WriteConsole(ghConsole ,buffer,(DWORD)strlen(buffer),&dw,NULL);
	return cnt;
}
 
void Patch(void)
{
	DWORD dwProcessId;
	dwProcessId = GetCurrentProcessId();
 
	HANDLE hProcess;
	hProcess = OpenProcess(PROCESS_ALL_ACCESS,false,dwProcessId);
	if(hProcess == 0){
		Debug("open process error \n");
	}else
	{
		Debug("the hProcess is : %x\n",(INT)hProcess);
	}
 
	LPVOID lpAddressStart,lpAddressDebug,lpAddressDebugStep;
 
	lpAddressStart=(LPVOID)0x000000014009147F;//启动注册框的爆破地址
	lpAddressDebug=(LPVOID)0x00000001400E3ED7;//debug对话框的爆破地址
	lpAddressDebugStep=(LPVOID)0x00000001400DA343;//debug step over对话框的爆破地址
 
	char je=0x74;//je指令
	SIZE_T dwNumberOfBytesRead;
	dwNumberOfBytesRead=0;
 
	if(WriteProceSSMemory(hProcess,lpAddressStart,&je,sizeof(je),&dwNumberOfBytesRead))
	{
		Debug("%d byte writed,start dialog patch ok!\n ",dwNumberOfBytesRead);
	}else
	{
		Debug("read error:%d \n", GetLastError());
 
	}
 
 
	unsigned char temp[5]={0x90,0x90,0x90,0x90,0x90};
 
	if(WriteProcessMemory(hProcess,lpAddressDebug,&temp,sizeof(temp),&dwNumberOfBytesRead))
	{
		Debug("%d byte writed,debug dialog patch ok!",dwNumberOfBytesRead);
	}else
	{
		Debug("read error:%d \n", GetLastError());
 
	}
 
 
	if(WriteProcessMemory(hProcess,lpAddressDebugStep,&temp,sizeof(temp),&dwNumberOfBytesRead))
	{
		Debug("%d byte writed,debug step over dialog patch ok!",dwNumberOfBytesRead);
	}else
	{
		Debug("read error:%d \n", GetLastError());
 
	}
 
	CloseHandle(hProcess);
}
 
// 入口函数
BOOL WINapi DllMain(HMODULE hModule, DWORD dwReason, PVOID pvReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{
		DisableThreadLibraryCalls(hModule);
 
		Patch();
 
	}
	else if (dwReason == DLL_PROCESS_DETACH)
	{
	}
 
	return TRUE;
}