使用Delphi编写DLL劫持内存补丁

旅行者一号 發表於 2023-7-28 18:29:00

在有些破解程序时，不能暴力修改程序，修改后，程序就不能正常运行，因为很多程序启动时有自我的校验，但是当程序加载到内存后，在内存中修改相应的地方就可以达到破解的效果。那么怎样在不破坏程序的前提下，达到修改程序呢？
当一个可执行文件运行时，Windows加载器将可执行模块映射到进程的地址空间中，加载器分析可执行模块的输入表，并设法找出任何需要的DLL，并将它们映射到进程的地址空间中。由于输入表中只包含DLL名而没有它的路径名，因此加载程序必须在磁盘上搜索DLL文件。首先会尝试从当前程序所在的目录加载DLL，如果没找到，则在Windows系统目录查找，最后是在环境变量中列出的各个目录下查找。利用这个特点，先伪造一个系统同名的DLL，提供同样的输出表，每个输出函数转向真正的系统DLL。程序调用系统DLL时会先调用当前目录下伪造的DLL，完成相关功能后，再跳到系统DLL同名函数里执行。这个过程用个形象的词来描述就是系统DLL被劫持了。
我们常用的系统的DLL有：
lpk.dll、msimg32.dll、version.dll、winmm.dll、usp10.dll、uxtheme.dll 等
为了完成对软件的破解，需要按以下步骤进行：
1、首先分析要破解的软件(以ZY_Modbus_Slave_sim.exe为例)调用了那些系统的dll文件，可以使用微软出品的进程资源管理器procexp64 https://download.sysinternals.com/files/ProcessExplorer.zip
<img src="https://img2023.cnblogs.com/blog/632606/202307/632606-20230714190546163-1341476866.png">
该软件调用了操作系统的uxtheme.dll文件
2、使用dllexp工具，分析出该系统untheme.dll的所有函数
<img src="https://img2023.cnblogs.com/blog/632606/202307/632606-20230714190940913-107900151.png">
将所有的函数名称保留出来，如下：
<img src="https://img2023.cnblogs.com/blog/632606/202307/632606-20230714191245117-440543983.png">
3、打开Delphi，创建一个Dll文件项目，项目名称修改保存为uxtheme,
根据每个函数名新建一个对应的指针，例如：
<div>BeginBufferedAnimation 新建一个指针 PoldBeginBufferedAnimation: Pointer;</div>
<div>对应创建一个过程：</div>
<div>
<div>procedure BeginBufferedAnimation;　　</div>
<div>asm jmp PoldBeginBufferedAnimation</div>
<div>end;</div>
<div>即原程序调用BeginBufferedAnimation函数时，自动调用 PoldBeginBufferedAnimation</div>
<div>程序在启动时将PoldBeginBufferedAnimation 指向原系统的 BeginBufferedAnimation函数
<div>PoldBeginBufferedAnimation := GetProcAddress(ModHandle, 'BeginBufferedAnimation');</div>
<div>这样就可以在dll运行时将所有的函数指向原系统的函数，同时可以在程序中加入自己的代码，到达不破坏原程序而进行内存修改程序的功能。</div>
<div>4、编程程序，生成untheme.dll文件</div>
<div>5、将untheme.dll文件拷贝到ZY_Modbus_Slave_sim.exe文件所在目录中，就可以完成内存补丁的破解工作。</div>
<div>ZY_Modbus_Slave_sim在启动调用untheme.dll时，自动调用执行同目录的这个文件。</div>
</div>
</div>
其样例程序如下（其中使用定时器在工作，具体可不使用这种方法，具体情况具体分析了）： 
<div class="cnblogs_code">
<pre>1 library uxtheme;
2
3 uses
4 Winapi.Windows,
5 Winapi.TlHelp32, Winapi.mmsystem,
6 Winapi.PsAPI,
7 System.SysUtils,
8 System.Classes;
9 {$R *.res}
 10 var
 11 ModHandle: Cardinal;
 12 CCID: DWORD;
 13 MMTimerID: Integer; // 定时器ID
 14
 15
 16 PoldBeginBufferedAnimation: Pointer;
 17 PoldBeginBufferedPaint: Pointer;
 18 PoldBeginPanningFeedback: Pointer;
 19 PoldBufferedPaintClear: Pointer;
 20 PoldBufferedPaintInit: Pointer;
 21 PoldBufferedPaintRenderAnimation: Pointer;
 22 PoldBufferedPaintSetAlpha: Pointer;
 23 PoldBufferedPaintStopAllAnimations: Pointer;
 24 PoldBufferedPaintUnInit: Pointer;
 25 PoldCloseThemeData: Pointer;
 26 PoldDllCanUnloadNow: Pointer;
 27 PoldDllGetActivationFactory: Pointer;
 28 PoldDllGetClassObject: Pointer;
 29 PoldDrawThemeBackground: Pointer;
 30 PoldDrawThemeBackgroundEx: Pointer;
 31 PoldDrawThemeEdge: Pointer;
 32 PoldDrawThemeIcon: Pointer;
 33 PoldDrawThemeParentBackground: Pointer;
 34 PoldDrawThemeParentBackgroundEx: Pointer;
 35 PoldDrawThemeText: Pointer;
 36 PoldDrawThemeTextEx: Pointer;
 37 PoldEnableThemeDialogTexture: Pointer;
 38 PoldEnableTheming: Pointer;
 39 PoldEndBufferedAnimation: Pointer;
 40 PoldEndBufferedPaint: Pointer;
 41 PoldEndPanningFeedback: Pointer;
 42 PoldGetBufferedPaintBits: Pointer;
 43 PoldGetBufferedPaintDC: Pointer;
 44 PoldGetBufferedPaintTargetDC: Pointer;
 45 PoldGetBufferedPaintTargetRect: Pointer;
 46 PoldGetColorFromPreference: Pointer;
 47 PoldGetCurrentThemeName: Pointer;
 48 PoldGetImmersiveColorFromColorSetEx: Pointer;
 49 PoldGetImmersiveUserColorSetPreference: Pointer;
 50 PoldGetThemeAnimationProperty: Pointer;
 51 PoldGetThemeAnimationTransform: Pointer;
 52 PoldGetThemeAppProperties: Pointer;
 53 PoldGetThemeBackgroundContentRect: Pointer;
 54 PoldGetThemeBackgroundExtent: Pointer;
 55 PoldGetThemeBackgroundRegion: Pointer;
 56 PoldGetThemeBitmap: Pointer;
 57 PoldGetThemeBool: Pointer;
 58 PoldGetThemeColor: Pointer;
 59 PoldGetThemeDocumentationProperty: Pointer;
 60 PoldGetThemeEnumValue: Pointer;
 61 PoldGetThemeFilename: Pointer;
 62 PoldGetThemeFont: Pointer;
 63 PoldGetThemeInt: Pointer;
 64 PoldGetThemeIntList: Pointer;
 65 PoldGetThemeMargins: Pointer;
 66 PoldGetThemeMetric: Pointer;
 67 PoldGetThemePartSize: Pointer;
 68 PoldGetThemePosition: Pointer;
 69 PoldGetThemePropertyOrigin: Pointer;
 70 PoldGetThemeRect: Pointer;
 71 PoldGetThemeStream: Pointer;
 72 PoldGetThemeString: Pointer;
 73 PoldGetThemeSysBool: Pointer;
 74 PoldGetThemeSysColor: Pointer;
 75 PoldGetThemeSysColorBrush: Pointer;
 76 PoldGetThemeSysFont: Pointer;
 77 PoldGetThemeSysInt: Pointer;
 78 PoldGetThemeSysSize: Pointer;
 79 PoldGetThemeSysString: Pointer;
 80 PoldGetThemeTextExtent: Pointer;
 81 PoldGetThemeTextMetrics: Pointer;
 82 PoldGetThemeTimingFunction: Pointer;
 83 PoldGetThemeTransitionDuration: Pointer;
 84 PoldGetUserColorPreference: Pointer;
 85 PoldGetWindowTheme: Pointer;
 86 PoldHitTestThemeBackground: Pointer;
 87 PoldIsAppThemed: Pointer;
 88 PoldIsCompositionActive: Pointer;
 89 PoldIsThemeActive: Pointer;
 90 PoldIsThemeBackgroundPartiallyTransparent: Pointer;
 91 PoldIsThemeDialogTextureEnabled: Pointer;
 92 PoldIsThemePartDefined: Pointer;
 93 PoldOpenThemeData: Pointer;
 94 PoldOpenThemeDataEx: Pointer;
 95 PoldOpenThemeDataForDpi: Pointer;
 96 PoldSetThemeAppProperties: Pointer;
 97 PoldSetWindowTheme: Pointer;
 98 PoldSetWindowThemeAttribute: Pointer;
 99 PoldThemeInitApiHook: Pointer;
100 PoldUpdatePanningFeedback: Pointer;
101
102
103 procedure BeginBufferedAnimation;
104 asm jmp PoldBeginBufferedAnimation
105 end;
106
108 procedure BeginBufferedPaint;
109 asm jmp PoldBeginBufferedPaint
110 end;
111 procedure BeginPanningFeedback;
112 asm jmp PoldBeginPanningFeedback
113 end;
114
115
116 procedure BufferedPaintClear;
117 asm jmp PoldBufferedPaintClear
118 end;
119
120
121 procedure BufferedPaintInit;
122 asm jmp PoldBufferedPaintInit
123 end;
124
125
126 procedure BufferedPaintRenderAnimation;
127 asm jmp PoldBufferedPaintRenderAnimation
128 end;
129
130
131 procedure BufferedPaintSetAlpha;
132 asm jmp PoldBufferedPaintSetAlpha
133 end;
134
135
136 procedure BufferedPaintStopAllAnimations;
137 asm jmp PoldBufferedPaintStopAllAnimations
138 end;
139
140
141 procedure BufferedPaintUnInit;
142 asm jmp PoldBufferedPaintUnInit
143 end;
144
145
146 procedure CloseThemeData;
147 asm jmp PoldCloseThemeData
148 end;
149
150
151 procedure DllCanUnloadNow;
152 asm jmp PoldDllCanUnloadNow
153 end;
154
155
156 procedure DllGetActivationFactory;
157 asm jmp PoldDllGetActivationFactory
158 end;
159
160
161 procedure DllGetClassObject;
162 asm jmp PoldDllGetClassObject
163 end;
164
165
166 procedure DrawThemeBackground;
167 asm jmp PoldDrawThemeBackground
168 end;
169
170
171 procedure DrawThemeBackgroundEx;
172 asm jmp PoldDrawThemeBackgroundEx
173 end;
174 procedure DrawThemeEdge;
175 asm jmp PoldDrawThemeEdge
176 end;
177
178
179 procedure DrawThemeIcon;
180 asm jmp PoldDrawThemeIcon
181 end;
182
183
184 procedure DrawThemeParentBackground;
185 asm jmp PoldDrawThemeParentBackground
186 end;
187
188
189 procedure DrawThemeParentBackgroundEx;
190 asm jmp PoldDrawThemeParentBackgroundEx
191 end;
192
193
194 procedure DrawThemeText;
195 asm jmp PoldDrawThemeText
196 end;
197
198
199 procedure DrawThemeTextEx;
200 asm jmp PoldDrawThemeTextEx
201 end;
202 procedure EnableThemeDialogTexture;
203 asm jmp PoldEnableThemeDialogTexture
204 end;
205
206
207 procedure EnableTheming;
208 asm jmp PoldEnableTheming
209 end;
210
211
212 procedure EndBufferedAnimation;
213 asm jmp PoldEndBufferedAnimation
214 end;
215
216
217 procedure EndBufferedPaint;
218 asm jmp PoldEndBufferedPaint
219 end;
220
221
222 procedure EndPanningFeedback;
223 asm jmp PoldEndPanningFeedback
224 end;
225
226
227 procedure GetBufferedPaintBits;
228 asm jmp PoldGetBufferedPaintBits
229 end;
230
231
232 procedure GetBufferedPaintDC;
233 asm jmp PoldGetBufferedPaintDC
234 end;
235 procedure GetBufferedPaintTargetDC;
236 asm jmp PoldGetBufferedPaintTargetDC
237 end;
238 procedure GetBufferedPaintTargetRect;
239 asm jmp PoldGetBufferedPaintTargetRect
240 end;
241
242
243 procedure GetColorFromPreference;
244 asm jmp PoldGetColorFromPreference
245 end;
246
247
248 procedure GetCurrentThemeName;
249 asm jmp PoldGetCurrentThemeName
250 end;
251 procedure GetImmersiveColorFromColorSetEx;
252 asm jmp PoldGetImmersiveColorFromColorSetEx
253 end;
254 procedure GetImmersiveUserColorSetPreference;
255 asm jmp PoldGetImmersiveUserColorSetPreference
256 end;
257
258
259 procedure GetThemeAnimationProperty;
260 asm jmp PoldGetThemeAnimationProperty
261 end;
262
263
264 procedure GetThemeAnimationTransform;
265 asm jmp PoldGetThemeAnimationTransform
266 end;
267 procedure GetThemeAppProperties;
268 asm jmp PoldGetThemeAppProperties
269 end;
270
271
272 procedure GetThemeBackgroundContentRect;
273 asm jmp PoldGetThemeBackgroundContentRect
274 end;
275
276
277 procedure GetThemeBackgroundExtent;
278 asm jmp PoldGetThemeBackgroundExtent
279 end;
280
281
282 procedure GetThemeBackgroundRegion;
283 asm jmp PoldGetThemeBackgroundRegion
284 end;
285 procedure GetThemeBitmap;
286 asm jmp PoldGetThemeBitmap
287 end;
288
289
290 procedure GetThemeBool;
291 asm jmp PoldGetThemeBool
292 end;
293
294
295 procedure GetThemeColor;
296 asm jmp PoldGetThemeColor
297 end;
298
299
300 procedure GetThemeDocumentationProperty;
301 asm jmp PoldGetThemeDocumentationProperty
302 end;
303
304
305 procedure GetThemeEnumValue;
306 asm jmp PoldGetThemeEnumValue
307 end;
308
309
310 procedure GetThemeFilename;
311 asm jmp PoldGetThemeFilename
312 end;
313
314
315 procedure GetThemeFont;
316 asm jmp PoldGetThemeFont
317 end;
318 procedure GetThemeInt;
319 asm jmp PoldGetThemeInt
320 end;
321 procedure GetThemeIntList;
322 asm jmp PoldGetThemeIntList
323 end;
324 procedure GetThemeMargins;
325 asm jmp PoldGetThemeMargins
326 end;
327
328
329 procedure GetThemeMetric;
330 asm jmp PoldGetThemeMetric
331 end;
332
333
334 procedure GetThemePartSize;
335 asm jmp PoldGetThemePartSize
336 end;
337
338
339 procedure GetThemePosition;
340 asm jmp PoldGetThemePosition
341 end;
342
343
344 procedure GetThemePropertyOrigin;
345 asm jmp PoldGetThemePropertyOrigin
346 end;
347
348
349 procedure GetThemeRect;
350 asm jmp PoldGetThemeRect
351 end;
352
353
354 procedure GetThemeStream;
355 asm jmp PoldGetThemeStream
356 end;
357
358
359 procedure GetThemeString;
360 asm jmp PoldGetThemeString
361 end;
362
363
364 procedure GetThemeSysBool;
365 asm jmp PoldGetThemeSysBool
366 end;
367
368
369 procedure GetThemeSysColor;
370 asm jmp PoldGetThemeSysColor
371 end;
372
373
374 procedure GetThemeSysColorBrush;
375 asm jmp PoldGetThemeSysColorBrush
376 end;
377
378
379 procedure GetThemeSysFont;
380 asm jmp PoldGetThemeSysFont
381 end;
382
383
384 procedure GetThemeSysInt;
385 asm jmp PoldGetThemeSysInt
386 end;
387
388
389 procedure GetThemeSysSize;
390 asm jmp PoldGetThemeSysSize
391 end;
392
393
394 procedure GetThemeSysString;
395 asm jmp PoldGetThemeSysString
396 end;
397
398
399 procedure GetThemeTextExtent;
400 asm jmp PoldGetThemeTextExtent
401 end;
402
403
404 procedure GetThemeTextMetrics;
405 asm jmp PoldGetThemeTextMetrics
406 end;
407
408
409 procedure GetThemeTimingFunction;
410 asm jmp PoldGetThemeTimingFunction
411 end;
412
413
414 procedure GetThemeTransitionDuration;
415 asm jmp PoldGetThemeTransitionDuration
416 end;
417 procedure GetUserColorPreference;
418 asm jmp PoldGetUserColorPreference
419 end;
420 procedure GetWindowTheme;
421 asm jmp PoldGetWindowTheme
422 end;
423
424
425 procedure HitTestThemeBackground;
426 asm jmp PoldHitTestThemeBackground
427 end;
428
429
430 procedure IsAppThemed;
431 asm jmp PoldIsAppThemed
432 end;
433
434
435 procedure IsCompositionActive;
436 asm jmp PoldIsCompositionActive
437 end;
438
439
440 procedure IsThemeActive;
441 asm jmp PoldIsThemeActive
442 end;
443
444
445 procedure IsThemeBackgroundPartiallyTransparent;
446 asm jmp PoldIsThemeBackgroundPartiallyTransparent
447 end;
448
449
450 procedure IsThemeDialogTextureEnabled;
451 asm jmp PoldIsThemeDialogTextureEnabled
452 end;
453
454
455 procedure IsThemePartDefined;
456 asm jmp PoldIsThemePartDefined
457 end;
458
459
460 procedure OpenThemeData;
461 asm jmp PoldOpenThemeData
462 end;
463 procedure OpenThemeDataEx;
464 asm jmp PoldOpenThemeDataEx
465 end;
466
467
468 procedure OpenThemeDataForDpi;
469 asm jmp PoldOpenThemeDataForDpi
470 end;
471
472
473 procedure SetThemeAppProperties;
474 asm jmp PoldSetThemeAppProperties
475 end;
476 procedure SetWindowTheme;
477 asm jmp PoldSetWindowTheme
478 end;
479
480
481 procedure SetWindowThemeAttribute;
482 asm jmp PoldSetWindowThemeAttribute
483 end;
484
485
486 procedure ThemeInitApiHook;
487 asm jmp PoldThemeInitApiHook
488 end;
489
490
491 procedure UpdatePanningFeedback;
492 asm jmp PoldUpdatePanningFeedback
493 end;
494
495
496 function AdjustProcessPrivilege(ProcessHandle: THandle; Token_Name: PChar): Boolean;//提权函数
497 var
498 // Token: Cardinal;
499 TokenHandle: NativeUint;
500 TokenPri: _TOKEN_PRIVILEGES;
501 ProcessDest: int64;
502 l: DWORD;
503 begin
504 Result := False;
505 // if OpenProcessToken(ProcessHandle, TOKEN_Adjust_Privileges, Token) then
506 if OpenProcessToken(ProcessHandle, TOKEN_Adjust_Privileges, TokenHandle) then
507 begin
508 if LookupPrivilegeValue(nil, Token_Name, ProcessDest) then
509 begin
510 TokenPri.PrivilegeCount := 1;
511 TokenPri.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
512 TokenPri.Privileges[0].Luid := ProcessDest;
513 l := 0;
514 // 更新进程令牌，成功返回TRUE
515 if AdjustTokenPrivileges(TokenHandle, False, TokenPri, SizeOf(TokenPri), nil, l) then
516 Result := True;
517 end;
518 end;
519 end;
520
521 function GetCCID: Boolean;
522 var
523 sProc: PROCESSENTRY32;
524 hSnap: DWORD;
525 ok, fd: BOOL;
526 FdTxt: string;
527 FindNum: Integer;
528 begin
529 sProc.dwSize := SizeOf(sProc);
530 hSnap := CreateToolHelp32Snapshot(TH32CS_SNAPPROCESS, 0);
531 Result := False;
532 ok := Process32First(hSnap, sProc);
533 FindNum := 0;
534 while ok do
535 begin
536 FdTxt := uppercase(sProc.szExeFile); //获取执行文件的名称
537 if FdTxt = 'ZY_MODBUS_SLAVE_SIM.EXE' then
538 begin
539 CCID := sProc.th32ProcessID; //获取执行文件的hid值
540 Result := True;
541 Inc(FindNum);
542 timeKillEvent(MMTimerID); //发现要破解的进程后，关闭定时执行
543 end;
544 ok := Process32Next(hSnap, sProc);//寻找下一个进程文件
545 if FindNum >= 1 then
546 Break;
547 end;
548 CloseHandle(hSnap);
549 end;
550
551
552 Procedure inject_LicenseService;
553 var
554 h, hModel: THandle;
555 tt2: NativeUint;
556 CrGold: byte;//要替换的字符
557 GoldA: Integer; //要破解的内存补丁地址
558 pPMC: PPROCESS_MEMORY_COUNTERS;
559 pPMCSize, ProcessPriority: Cardinal;
560 n: DWORD;
561
562 begin
563 if GetCCID then
564 begin
565 h := OpenProcess(PROCESS_ALL_ACCESS, False, CCID);
566 if h = 0 then
567 begin
568 // GetLastError;
569 //不能打开线程OpenProcess
570 exit;
571 end;
572 // 从开始执行移动到每秒执行
573 pPMCSize := SizeOf(PROCESS_MEMORY_COUNTERS);
574 GetMem(pPMC, pPMCSize);
575 pPMC.cb := pPMCSize;
576 if GetProcessMemoryInfo(h, pPMC, pPMCSize) then
577 begin
578 // 根据进程句柄找到模块句柄
579 ENumProcessModules(h, @hModel, SizeOf(hModel), n);
580 GoldA:= 4270327; // 内存地址 004128f7 转换成10进制//要破解的内存补丁地址
581 CrGold := 235; // 004128f7 的字符替换成'EB'
582 WriteProcessMemory(h, ptr(GoldA), @CrGold, 1, tt2); //写入内存
583 CloseHandle(h);
584 exit;
585 end;
586 end;
587 end;
588
589
590 procedure TimerProc(uTimerID, uMessage: UINT; dwUser, dw1, dw2: DWORD); stdcall;
591 begin
592 // 业务代码
593 inject_LicenseService; // 定时执行
594 end;
595 // 主程序开始.............................
596 exports
597 BeginBufferedAnimation,
598 BeginBufferedPaint,
599 BeginPanningFeedback,
600 BufferedPaintClear,
601 BufferedPaintInit,
602 BufferedPaintRenderAnimation,
603 BufferedPaintSetAlpha,
604 BufferedPaintStopAllAnimations,
605 BufferedPaintUnInit,
606 CloseThemeData,
607 DllCanUnloadNow,
608 DllGetActivationFactory,
609 DllGetClassObject,
610 DrawThemeBackground,
611 DrawThemeBackgroundEx,
612 DrawThemeEdge,
613 DrawThemeIcon,
614 DrawThemeParentBackground,
615 DrawThemeParentBackgroundEx,
616 DrawThemeText,
617 DrawThemeTextEx,
618 EnableThemeDialogTexture,
619 EnableTheming,
620 EndBufferedAnimation,
621 EndBufferedPaint,
622 EndPanningFeedback,
623 GetBufferedPaintBits,
624 GetBufferedPaintDC,
625 GetBufferedPaintTargetDC,
626 GetBufferedPaintTargetRect,
627 GetColorFromPreference,
628 GetCurrentThemeName,
629 GetImmersiveColorFromColorSetEx,
630 GetImmersiveUserColorSetPreference,
631 GetThemeAnimationProperty,
632 GetThemeAnimationTransform,
633 GetThemeAppProperties,
634 GetThemeBackgroundContentRect,
635 GetThemeBackgroundExtent,
636 GetThemeBackgroundRegion,
637 GetThemeBitmap,
638 GetThemeBool,
639 GetThemeColor,
640 GetThemeDocumentationProperty,
641 GetThemeEnumValue,
642 GetThemeFilename,
643 GetThemeFont,
644 GetThemeInt,
645 GetThemeIntList,
646 GetThemeMargins,
647 GetThemeMetric,
648 GetThemePartSize,
649 GetThemePosition,
650 GetThemePropertyOrigin,
651 GetThemeRect,
652 GetThemeStream,
653 GetThemeString,
654 GetThemeSysBool,
655 GetThemeSysColor,
656 GetThemeSysColorBrush,
657 GetThemeSysFont,
658 GetThemeSysInt,
659 GetThemeSysSize,
660 GetThemeSysString,
661 GetThemeTextExtent,
662 GetThemeTextMetrics,
663 GetThemeTimingFunction,
664 GetThemeTransitionDuration,
665 GetUserColorPreference,
666 GetWindowTheme,
667 HitTestThemeBackground,
668 IsAppThemed,
669 IsCompositionActive,
670 IsThemeActive,
671 IsThemeBackgroundPartiallyTransparent,
672 IsThemeDialogTextureEnabled,
673 IsThemePartDefined,
674 OpenThemeData,
675 OpenThemeDataEx,
676 OpenThemeDataForDpi,
677 SetThemeAppProperties,
678 SetWindowTheme,
679 SetWindowThemeAttribute,
680 ThemeInitApiHook,
681 UpdatePanningFeedback;
682 const
683 {$IF Defined(CPUX86)}
684 xpath = 'system32';
685 {$ELSEIF Defined(CPUX64)}
686 xpath = 'SysWOW64';
687 {$IFEND}
688 begin
689 ModHandle := LoadLibrary('C:\WINDOWS\' + xpath + '\uxtheme.dll');
690 if ModHandle > 0 then
691 begin
692 PoldBeginBufferedAnimation := GetProcAddress(ModHandle, 'BeginBufferedAnimation');
693 PoldBeginBufferedPaint := GetProcAddress(ModHandle, 'BeginBufferedPaint');
694 PoldBeginPanningFeedback := GetProcAddress(ModHandle, 'BeginPanningFeedback');
695 PoldBufferedPaintClear := GetProcAddress(ModHandle, 'BufferedPaintClear');
696 PoldBufferedPaintInit := GetProcAddress(ModHandle, 'BufferedPaintInit');
697 PoldBufferedPaintRenderAnimation := GetProcAddress(ModHandle, 'BufferedPaintRenderAnimation');
698 PoldBufferedPaintSetAlpha := GetProcAddress(ModHandle, 'BufferedPaintSetAlpha');
699 PoldBufferedPaintStopAllAnimations := GetProcAddress(ModHandle, 'BufferedPaintStopAllAnimations');
700 PoldBufferedPaintUnInit := GetProcAddress(ModHandle, 'BufferedPaintUnInit');
701 PoldCloseThemeData := GetProcAddress(ModHandle, 'CloseThemeData');
702 PoldDllCanUnloadNow := GetProcAddress(ModHandle, 'DllCanUnloadNow');
703 PoldDllGetActivationFactory := GetProcAddress(ModHandle, 'DllGetActivationFactory');
704 PoldDllGetClassObject := GetProcAddress(ModHandle, 'DllGetClassObject');
705 PoldDrawThemeBackground := GetProcAddress(ModHandle, 'DrawThemeBackground');
706 PoldDrawThemeBackgroundEx := GetProcAddress(ModHandle, 'DrawThemeBackgroundEx');
707 PoldDrawThemeEdge := GetProcAddress(ModHandle, 'DrawThemeEdge');
708 PoldDrawThemeIcon := GetProcAddress(ModHandle, 'DrawThemeIcon');
709 PoldDrawThemeParentBackground := GetProcAddress(ModHandle, 'DrawThemeParentBackground');
710 PoldDrawThemeParentBackgroundEx := GetProcAddress(ModHandle, 'DrawThemeParentBackgroundEx');
711 PoldDrawThemeText := GetProcAddress(ModHandle, 'DrawThemeText');
712 PoldDrawThemeTextEx := GetProcAddress(ModHandle, 'DrawThemeTextEx');
713 PoldEnableThemeDialogTexture := GetProcAddress(ModHandle, 'EnableThemeDialogTexture');
714 PoldEnableTheming := GetProcAddress(ModHandle, 'EnableTheming');
715 PoldEndBufferedAnimation := GetProcAddress(ModHandle, 'EndBufferedAnimation');
716 PoldEndBufferedPaint := GetProcAddress(ModHandle, 'EndBufferedPaint');
717 PoldEndPanningFeedback := GetProcAddress(ModHandle, 'EndPanningFeedback');
718 PoldGetBufferedPaintBits := GetProcAddress(ModHandle, 'GetBufferedPaintBits');
719 PoldGetBufferedPaintDC := GetProcAddress(ModHandle, 'GetBufferedPaintDC');
720 PoldGetBufferedPaintTargetDC := GetProcAddress(ModHandle, 'GetBufferedPaintTargetDC');
721 PoldGetBufferedPaintTargetRect := GetProcAddress(ModHandle, 'GetBufferedPaintTargetRect');
722 PoldGetColorFromPreference := GetProcAddress(ModHandle, 'GetColorFromPreference');
723 PoldGetCurrentThemeName := GetProcAddress(ModHandle, 'GetCurrentThemeName');
724 PoldGetImmersiveColorFromColorSetEx := GetProcAddress(ModHandle, 'GetImmersiveColorFromColorSetEx');
725 PoldGetImmersiveUserColorSetPreference := GetProcAddress(ModHandle, 'GetImmersiveUserColorSetPreference');
726 PoldGetThemeAnimationProperty := GetProcAddress(ModHandle, 'GetThemeAnimationProperty');
727 PoldGetThemeAnimationTransform := GetProcAddress(ModHandle, 'GetThemeAnimationTransform');
728 PoldGetThemeAppProperties := GetProcAddress(ModHandle, 'GetThemeAppProperties');
729 PoldGetThemeBackgroundContentRect := GetProcAddress(ModHandle, 'GetThemeBackgroundContentRect');
730 PoldGetThemeBackgroundExtent := GetProcAddress(ModHandle, 'GetThemeBackgroundExtent');
731 PoldGetThemeBackgroundRegion := GetProcAddress(ModHandle, 'GetThemeBackgroundRegion');
732 PoldGetThemeBitmap := GetProcAddress(ModHandle, 'GetThemeBitmap');
733 PoldGetThemeBool := GetProcAddress(ModHandle, 'GetThemeBool');
734 PoldGetThemeColor := GetProcAddress(ModHandle, 'GetThemeColor');
735 PoldGetThemeDocumentationProperty := GetProcAddress(ModHandle, 'GetThemeDocumentationProperty');
736 PoldGetThemeEnumValue := GetProcAddress(ModHandle, 'GetThemeEnumValue');
737 PoldGetThemeFilename := GetProcAddress(ModHandle, 'GetThemeFilename');
738 PoldGetThemeFont := GetProcAddress(ModHandle, 'GetThemeFont');
739 PoldGetThemeInt := GetProcAddress(ModHandle, 'GetThemeInt');
740 PoldGetThemeIntList := GetProcAddress(ModHandle, 'GetThemeIntList');
741 PoldGetThemeMargins := GetProcAddress(ModHandle, 'GetThemeMargins');
742 PoldGetThemeMetric := GetProcAddress(ModHandle, 'GetThemeMetric');
743 PoldGetThemePartSize := GetProcAddress(ModHandle, 'GetThemePartSize');
744 PoldGetThemePosition := GetProcAddress(ModHandle, 'GetThemePosition');
745 PoldGetThemePropertyOrigin := GetProcAddress(ModHandle, 'GetThemePropertyOrigin');
746 PoldGetThemeRect := GetProcAddress(ModHandle, 'GetThemeRect');
747 PoldGetThemeStream := GetProcAddress(ModHandle, 'GetThemeStream');
748 PoldGetThemeString := GetProcAddress(ModHandle, 'GetThemeString');
749 PoldGetThemeSysBool := GetProcAddress(ModHandle, 'GetThemeSysBool');
750 PoldGetThemeSysColor := GetProcAddress(ModHandle, 'GetThemeSysColor');
751 PoldGetThemeSysColorBrush := GetProcAddress(ModHandle, 'GetThemeSysColorBrush');
752 PoldGetThemeSysFont := GetProcAddress(ModHandle, 'GetThemeSysFont');
753 PoldGetThemeSysInt := GetProcAddress(ModHandle, 'GetThemeSysInt');
754 PoldGetThemeSysSize := GetProcAddress(ModHandle, 'GetThemeSysSize');
755 PoldGetThemeSysString := GetProcAddress(ModHandle, 'GetThemeSysString');
756 PoldGetThemeTextExtent := GetProcAddress(ModHandle, 'GetThemeTextExtent');
757 PoldGetThemeTextMetrics := GetProcAddress(ModHandle, 'GetThemeTextMetrics');
758 PoldGetThemeTimingFunction := GetProcAddress(ModHandle, 'GetThemeTimingFunction');
759 PoldGetThemeTransitionDuration := GetProcAddress(ModHandle, 'GetThemeTransitionDuration');
760 PoldGetUserColorPreference := GetProcAddress(ModHandle, 'GetUserColorPreference');
761 PoldGetWindowTheme := GetProcAddress(ModHandle, 'GetWindowTheme');
762 PoldHitTestThemeBackground := GetProcAddress(ModHandle, 'HitTestThemeBackground');
763 PoldIsAppThemed := GetProcAddress(ModHandle, 'IsAppThemed');
764 PoldIsCompositionActive := GetProcAddress(ModHandle, 'IsCompositionActive');
765 PoldIsThemeActive := GetProcAddress(ModHandle, 'IsThemeActive');
766 PoldIsThemeBackgroundPartiallyTransparent := GetProcAddress(ModHandle, 'IsThemeBackgroundPartiallyTransparent');
767 PoldIsThemeDialogTextureEnabled := GetProcAddress(ModHandle, 'IsThemeDialogTextureEnabled');
768 PoldIsThemePartDefined := GetProcAddress(ModHandle, 'IsThemePartDefined');
769 PoldOpenThemeData := GetProcAddress(ModHandle, 'OpenThemeData');
770 PoldOpenThemeDataEx := GetProcAddress(ModHandle, 'OpenThemeDataEx');
771 PoldOpenThemeDataForDpi := GetProcAddress(ModHandle, 'OpenThemeDataForDpi');
772 PoldSetThemeAppProperties := GetProcAddress(ModHandle, 'SetThemeAppProperties');
773 PoldSetWindowTheme := GetProcAddress(ModHandle, 'SetWindowTheme');
774 PoldSetWindowThemeAttribute := GetProcAddress(ModHandle, 'SetWindowThemeAttribute');
775 PoldThemeInitApiHook := GetProcAddress(ModHandle, 'ThemeInitApiHook');
776 PoldUpdatePanningFeedback := GetProcAddress(ModHandle, 'UpdatePanningFeedback');
777 end;
778 begin
779 // 添加自己的补丁内容！
780 AdjustProcessPrivilege(GetCurrentProcess, 'SeDebugPrivilege'); // 提升权限
781 MMTimerID := timeSetEvent(500, 0, @TimerProc, 0, TIME_PERIODIC); // 启动定时器，定时执行TimerProc函数
782 end;
783 end.</pre>
</div>
  
来源：https://www.cnblogs.com/blockke/p/17588654.html

頁: [1]

琼殿技术论坛's Archiver

使用Delphi编写DLL劫持内存补丁