Re: Help with a patch

From:

"Alexander Nickolov" <agnickolov@mvps.org>

Newsgroups:

microsoft.public.vc.language

Date:

Wed, 25 Jul 2007 11:29:55 -0700

Message-ID:

<Oy4jNnuzHHA.3564@TK2MSFTNGP04.phx.gbl>

It is a reference to the importlib for user32.dll. You'd want to
patch it to the address of CallWindowProc in the target process'
copy of user32.dll (e.g. LoadLibrary/GetProcAddress).

--
=====================================
Alexander Nickolov
Microsoft MVP [VC], MCSD
email: agnickolov@mvps.org
MVP VC FAQ: http://vcfaq.mvps.org
=====================================

"Vincent Fatica" <vince@blackholespam.net> wrote in message
news:46a7659f$1@news.vefatica.net...

I want to inject the following code into the host of my DLL and patch it to
remove references to memory locations in my DLL.

#pragma code_seg(".inject")
LRESULT CALLBACK MyWindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM
lParam)
{
if ( uMsg == WM_SYSCOMMAND && (wParam & 0xFFF0) == SC_CLOSE )
wParam = SC_MINIMIZE;

return CallWindowProc(OldWndProc, hwnd, uMsg, wParam, lParam);
}
#pragma code_seg()
#pragma comment(linker, "/SECTION:.inject,R")
#define INJECT_SIZE 0x3E // from DUMPBIN.EXE

As far as I can tell the only reference to memory locations in my DLL is
the
reference to "OldWndProc" (gotten when the new WNDPROC is set). But when
I look
at the machine code I see two references to memory locations in my DLL:

55 8B EC 81 7D 0C 12 01 00 00 75 16 8B 45 10 25
F0 FF 00 00 3D 60 F0 00 00 75 07 C7 45 10 20 F0
00 00 FF 75 14 FF 75 10 FF 75 0C FF 75 08 FF 35
[ 60 F0 7E 01 ] FF 15 [ 2C C1 7E 01 ] 5D C2 10 00

The first is the expected location of "OldWndProc". What's the second?
If it's
a jump to CallWindowProc, how would I patch it? [The exe is build with
Borland.]

Thanks.
--
- Vince