Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Yes you can do that, using the <a href="http://msdn.microsoft.com/en-us/library/ms680553%28VS.85%29.aspx" rel="noreferrer"><code>ReadProcessMemory</code></a> and <a href="http://msdn.microsoft.com/en-us/library/ms681674%28VS.85%29.aspx" rel="noreferrer"><code>WriteProcessMemory</code></a> functions to patch the code of the current process. Basically, you get the address of the procedure or function to patch and then insert a Jump instruction to the address of the new procedure.</p> <p>Check this code</p> <pre><code>Uses uThirdParty; //this is the unit where the original DataCompare function is declarated type //strctures to hold the address and instructions to patch TJumpOfs = Integer; PPointer = ^Pointer; PXRedirCode = ^TXRedirCode; TXRedirCode = packed record Jump: Byte; Offset: TJumpOfs; end; PAbsoluteIndirectJmp = ^TAbsoluteIndirectJmp; TAbsoluteIndirectJmp = packed record OpCode: Word; Addr: PPointer; end; var DataCompareBackup: TXRedirCode; //Store the original address of the function to patch //this is the implementation of the new function function DataCompareHack(const S1, S2: string; APartial: Boolean): Boolean; begin //here write your own code end; //get the address of a procedure or method of a function function GetActualAddr(Proc: Pointer): Pointer; begin if Proc &lt;&gt; nil then begin if (Win32Platform = VER_PLATFORM_WIN32_NT) and (PAbsoluteIndirectJmp(Proc).OpCode = $25FF) then Result := PAbsoluteIndirectJmp(Proc).Addr^ else Result := Proc; end else Result := nil; end; //patch the original function or procedure procedure HookProc(Proc, Dest: Pointer; var BackupCode: TXRedirCode); var n: {$IFDEF VER230}NativeUInt{$ELSE}DWORD{$ENDIF}; Code: TXRedirCode; begin Proc := GetActualAddr(Proc); Assert(Proc &lt;&gt; nil); //store the address of the original procedure to patch if ReadProcessMemory(GetCurrentProcess, Proc, @BackupCode, SizeOf(BackupCode), n) then begin Code.Jump := $E9; Code.Offset := PAnsiChar(Dest) - PAnsiChar(Proc) - SizeOf(Code); //replace the target procedure address with the new one. WriteProcessMemory(GetCurrentProcess, Proc, @Code, SizeOf(Code), n); end; end; //restore the original address of the hooked function or procedure procedure UnhookProc(Proc: Pointer; var BackupCode: TXRedirCode); var n: {$IFDEF VER230}NativeUInt{$ELSE}Cardinal{$ENDIF}; begin if (BackupCode.Jump &lt;&gt; 0) and (Proc &lt;&gt; nil) then begin Proc := GetActualAddr(Proc); Assert(Proc &lt;&gt; nil); WriteProcessMemory(GetCurrentProcess, Proc, @BackupCode, SizeOf(BackupCode), n); BackupCode.Jump := 0; end; end; //Patch the original procedure or function procedure HookDataCompare; begin //look how is passed the address of the original procedure (including the unit name) HookProc(@uThirdParty.DataCompare, @DataCompareHack, DataCompareBackup); end; //restore the address of the original procedure or function procedure UnHookDataCompare; begin UnhookProc(@uThirdParty.DataCompare, DataCompareBackup); end; initialization HookDataCompare; finalization UnHookDataCompare; end. </code></pre> <p>Now every time you execute your app and a call to the <code>DataCompare</code> function was made, the jump instruction (to he new address) will be executed causing which the <code>DataCompareHack</code> function will be called instead.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload