        

     18 

      Win32     4-  
   32-   000000000  OxFFFFFFFF. 
,        ,   
     ,      
,   ,   . ,   
   , -      
,     ,   . 
         16- Windows  ,    
    .  -    
-  ,  ,       
  ( !)  .   Win32,   
  ,      
 . 

    \wiNDows7 
     Windows 95     2   
 ( 080000000  OxFFFFFFFF).      
   ,    ( .  5  8). 

        Win32    ,  
 .  ,   Win32    
   ,        
          .   
16-   Windows   ,     
  .     Win32     . 
        Win32  ,      
  .   : 
       ,   ; 
      (,  ,  DLL   ); 
       (hooking)   . 
           ,    Win32-npouecc 
    .       
 (injecting) - DLL     . 

    600 ______________________________Windows   


          

    ,       ,  
 . ,   ,    .  
16- Windows        SetWindowLong  
  ,  ,       
    WndProc.    Win32 (,   
 SetWindowLong) ,       
,   .    .   
            
 .   16- Windows,    Win32 : 

    SetWindowLong(hwnd. GWL_WNDPROC, MySubclassProc); 

     ,    ,    hwnd, 
     ,   MySubclassProc. 
 ,         
WndProc,        WndProc.    
 ,       MySubclassProc,  
   ,     . 
     Win32     ,   
,   ,        
.       
  . 18-1. ,     .  
USER32.DLL      .   
USER32.DLL       (  
),    ,    . 
 - ,     WndProc   
 ,   ,    wParam  IParam. 
 WndProc  , USER32       
   . 
     ,       ,  
    .       
  ,      .    
. 18-1      FindWindow,   SetWindowLong, 
     WndProc.  : . 
 Win32     ,  NULL.  SetWindowLong  
,       WndProc ,  
 , ,  ,  . 
       Win32-peaa  SetWindowLong   
  WndProc7       
MySubclassProc   .        
USER32       ,   MySubclassProc  
      .       
,   MySubclassProc     
 ,     . ,  USER32    
,        -     
  , , ,     . 
      ,     ,  MySubclassProc 
     ,      
    . ,     
    : 
      ,    ,   
.         
,     Win32   . 
            . 

    _____________________ 18.     601 


                                  
    _________________________         _______________________| 
    -                             -                         : 
    LRESULT WndProc (HWND hwnd, UNIT uMsg. .,.) {             void SomeFunc 
(void) {                              .; 
    ;                                                          HWNO hwnd ^ 
FindWindow("Class-A". NULL):           :, 
    SetWindowLong(hwnd, GWL_WNDPROC,                   .; 
    MySubClassProc); 
    } 
    LHESULT MySubClassProc (HWND hwnd, UNIT uMsg, ...) { 
    )__________________________________ 
    ___________________________________I     ___________________________________I 
     USER32.DLL                       USER32.DLL 
    LONG DIspatchMessage (CONST MSG msg) !                   : 
    LONG IResult: 
    WNDPROC IpfriWndProc = (WNDPROC) 
    GetWindowLongfmsg, hwnd, GWL..WNDPROC); 
    IResult = lpfnWndProc(nisg, hwnd, msg. 
    message, wParam, IParam); 
    return(lResult); 
    )_______________________________                          ___   ___        
   __________ 
    I    I 

    . 18-1.       ,  
   

      MySubclassProc       ,  
       ? 
      USER32 ,       ? 
         , Microsoft   
 SetWindowLong   ,   . 
         ,   , 
:     .       
   ,      
.            
   ,     SetWindowLong  
   MySubclassProc   .     
 DLL    .     
 .    ,   . 

     DLL    

         Windows 95  Windows NT,  ,   
 (registry).  ,  !     
 , ,       ,   
 .      : 

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs 

    VWINDOWS/ 
    Windows 95    ,      
 DLL  . 

    602 ______________________________Windows   

        ,   AppInit_DLLs,  
    Windows NT  Registry Editor ( 
).   AppInit_DLLs      DLL ( 
  ),     DLL,  .  
     C:\MYLIB.DLL. 

    Registry Edit View Help 
    :                  _J MCIE:<ipnsions3 NamB__^_^__._J Date____ 
    '                  _1 MC.132                     .^(Default)      '    
""(value not set) 
    _J Midimap                   'yApplnitJXLs        "C:\MYLIB.DLL" 
    I ModuleCompatibility         .^DeviceNotSelected... "15" 
     _J Network                   ^Spooler            "yes" 
    ; .       EH_] NetrorkCards              "ilswapdisk 
    !        '. C3 OpenGLDrivers             .a3TransmissionRetry... "90" 
     _J Perilib 
    _J Ports 
              :        aI ProfileList 
    !_] related.desc 
    +   I Time Zones 
    + _} Type 1 Installer 
    ;                    l'"i Userinstallable.drivers 
    ^^EuSftBBftI 
    " j Winlogon 
    <:; .^J WOW 
    Ll Nikita 
    I         CJ ODBC 
    LJ Program Groups 
    :   CJ Secure 
    +' _1 Windows 31 Migration Status      I 
    + _J SYSTEM                         _j 
    ll_____________ ...L'll.-l .._._, .... ............I          .. .2J 
    MyC:omputeAHKEY_LOC^L_MACHlNE\SOF^ARE\Microsof^windowsNT\CurrentVersion\^^^ 

       \32- Windows NT   
 . ,   USER32.DLL    
 , USER32      
Win32-noncHCTeMbi   LoadLibrary   DLL,    
AppInit_DLLs.    DLL-    
 DllMain   fwdReason,  DLL_PROCESS_ATTACH.   
USER32  ,       DLL. 
        DLL. ,    ,   
     .     . 
    -,   Win32-occea     
,      .   
     . 
    -,  DLL        
,     USER32.      
GUI-, . .        
,  ,   . 
    -,  DLL        
.  -     DLL     
  .       
 DLL,    .      
  ,         
,        . 
    DLL      . 

    _____________________ 18.     603 

    , ,  DLL   GUI-     
.       .   
  DLL    ,       
    . ,     
  WordPad   ,     
. ,     ,  DLL  
  WordPad  .     
,      WordPad. 
    DLL       WordPad. 
      DLL    ,     
   . 

     DLL    

     DLL         
.     Win32  ,   16- Windows, 
Microsoft   ,   DLL   
  .    . 
      (  Spy++)   WH_GETMESSAGE  
  ,    .  
  SetWindowsHookEx: 

     hHook = SetWindowsHookEx(WH_GETMESSAGE, GetMsgProc, hinstDll. NULL); 

     WH_GETMESSAGE   , a GetMsgProc   
 (    ),    
  ,     .  
hinstDll  DLL,   GetMsgProc.  Win32  
hinstDll   DLL   32-    
,   DLL     . , 
,  , NULL,  ,    
.    SetWindowsHookEx     
   .  NULL,   ,   
      . 
     ,    : 
    1.       - . 
    2.  ,        WH_GETMESSAGE. 
    3.  ,   DLL,   GetMsgProc,  
   . 
    4.   DLL   ,     
        (lock count) 
 DLL     1. 
    5.  ,     hinstDll,   
   .  hinstDll    ,    
GetMsgProc     .      
GetMsgProc     . 
    6.   hinstDll ,     GetMsgProc 
      : 
    GetMsgProc  = histDll  + (GetMsgProc  - hinstDll ) 

    604 ______________________________Windows   

     hinstDU   GetMsgProc ,    ( )  
 GetMsgProc.     hinstDll ,    
GetMsgProc,   DLL     . 
    7.    DLL      1. 
    8.  GetMsgProc     . 
    9.    GetMsgProc    DLL   
     1. 
            Win32. ,  
    DLL,     , 
  DLL,    -.  , , 
    ,      DLL. 
     ,    ,    
,     WH_GETMESSAGE   ,  
      GetMsgProc   SetWindowLongti 
 . ,        DLL,  
 GetMsgProc. 
        DLL         
  DLL    ,    : 

    BOOL UnhookWindowsHookEx(HHOOK hHook): 

         ,    
 ,       DLL,   
    1.     , DLL 
      . 
:       GetMsgProc 
(.  . 7).       .   
  ,       UnhookWindowsHookExa 
 ,        GetMsgProc. 
      ,           
        . 

            

            , ,   
,       1152  864.     
    ,       
640  480.      ,   
Display ()  Control Panel ( )    
640  480,   ,    Display   
 1152  864. 
             
 Windows 95  Windows NT 4. ,     ,   
          
(desktop).             
   .    ,  
  ,    ,     
.      ,     
.   ,      
      ! 
     ,    ,    ,  
    (Desktop Item Position Saver, DIPS). DIPS  
      DLL.   , 
   : 

    _____________________ 18.     605 


    DIPS: Desktop Item Position Saver Utility 
    Copyright (c) 1 97 by Jeffrey RIchter.               | 
    This utility saves/restores the position of items on the desktop. 
    ! 1-1 save the desktop item positions: DIPS S 
     restore the desktop item positions: DIPS R 
    Save    I           Restore   |           Cancel 
     J1       1             '                      

       ,    .     
 S   ,    : 

    HKEY_CURRENT_USER\Software\Richter\Desktop Item Position Saver 

           ,   
  .       
.  DIPS      . 
     ,   DIPS 
      R.  DIPS     
         . 
        DIPS      . 
   ,       
 (ListView)  ,   (  
)       ,   
    .  ,   ,   
  .   ,      
   (, LVM_GETITEM  LVM_GETITEMPOSITION) 
    . ? 
     LVM_GETITEM ,      EPARAM  
 EV_ITEM.          
   , -    
 .' ,  DIPS  ,   ,  
EXPEORER.EXE   ,   EVM_GETITEM  
LVM_GETITEMPOSITION      . 
       ,      :  
 DIPS.EXE,     DIPS.,   
DIPSLIB.DLL,     DIPSLIB.C.      
    DIPSLIB.H (   .  . 18-2). 
       DIPS.EXE     
   : 

    //  Desktop ListView - ""  ProgMan 
    hwndLV = GetFirstChild(GetFirstChild(FindWindow(__TEXT("ProgMan"), NULL))): 

    1.         (, 
 , , ,    . .)  
     . , , 
 -   ,    
LB_GETTEXT,   LPARAM       
 -.  ,    
  ,     LB_GETTEXT, ,  
,            
       . 
     Microsoft         
?  16- Windows,       
  ,      
LB_GETTEXT ,   .     
  Win32, Microsoft     .    
16- Windows    ,      
 ,  Microsoft       . 

    606 ______________________________Windows   

          ProgMan.    ,  
 Program Manager  ,   -  
       ,    
 Windows.   ProgMan     
SHELLDLL_DefView,         SysListView32. 
-        .2 
        ,    
  ,    GetWindowThreadProcessId.  
    SetDIPSHook,    DIPSLIB.C. 
    WH_GETMESSAGE     : 

    PostThreadMessage(dwThreadId, WM_NULL, 0. 0); 

       Explorer ().     
WH_GETMESSAGE,      DIPSLIB.DLL 
    Explorer     GetMsgProc. 
  ,    , ,  ,    
  Richter DIPS.   ,     , 
 Explorer.   ,  DIPS.EXE   
 SetDIPSHook  : 

    GetMessage(&msg, NULL, , ); 

            - 
.  DIPS.EXE      ,      
 ,         
PostThreadMessage.    GetMsgProc  DIPSLIB.C:   
  CreateDialog   PostThreadMessage,   
  DIPS.EXE.       
  SetDIPSHook. 
          .     
,        , 
      , ,   . . (Win32  
  API;  .) 
      DIPS.EXE ,  ,    
  ,    FindWindow,    .  
       ( DIPS)  
 (  )     
.      ,   
  Explorer,         Explorer. 
        ,      
    ,   : 
    
    //   DIPS.       
    //   :      
    SendMessage(hwndDIPS, WM_APP, (WPARAM) hwndLV, fSave): 
    
         WM_APP.    
 ,  WPARAM      
 , a LPARAM    , 
,        . 
        SendMessage,   PostMessage,   
   .  ,   
          
  Explorer. 2, ,       
Spy++ (  Visual C++). 

    _____________________ 18.     607 

    ,    ,      WM_CLOSE, 
      . 
    ,    DIPS   SetDIPSHook,   
       0.   
,    WH_GETMESSAGE.    , 
    DIPSLIB.DLL   
  Explorer,   ,    
       .  
        .   
,   ,   .   
Explorer         DLL 
 ! 

    DIPS. 
    : DIPS, 
    : Copyright  1996-1997,   (Jeffrey Richter) 
    #include "..\CmnHdr.H"              /* ,   */ 
    ttinclude <Windows.H> 
    ffinclude <WindowsX.H> 
    ftinclude <tchar.h> 
    ftinclude "Resource.h" 
    tt^clnrip  \rnPSLih\DIPSLib.h" 
    /////////////////////////////////////////////7///7//////7//7//////////.' . 
     
    BOOL Dlg_OnInitDialog (HWND hwnd, HWND hwndFocus, LPARAM IParam) { 
    
    //      
    chSETDLGICONS(hwnd, IDI_DIPS, IDI_DIPS); 
    return(TRUE): 
    1111111111111111111111111111111111111111111111111111111111111111111111111111111 
    
    void Dlg_OnGommand (HWND hwnd, int id, HWND hwndCtI, UINT codeNotify) { 
    switch (id) { 
    case IDC_SAVE: 
    case IDC_RESTORE: 
    case IDCANCEL: 
    EndDialog(hwnd, id); 
    break; 
    111 1-1 7. 41111111111111111111111111111111111111111111111111111111111111111111 

    . . . 

    . 18-2.   DIPS 

    608 ______________________________Windows   


    . 18-2 () 

    BOOL CALLBACK Dlg_Proc (HWND hwnd, UINT uMsg, WPARAM wPar-am, LPARAM 
IParam) { 
    switch (uMsg) { 
    chHANDLE_DLGMSG(hwnd, WM_INITDIALOG, Dlg_OnInitDlalog); 
    chHANDLE_DLGMSG(hwnd. WM COMMAND. Dln_OnCorn"iand): 
    return(FALSE); 
    \ i 
    /'/////7///7/'/77/////////////////////////, '/' ,. ' :: ' 
''',','/' 'i- ': :'i  '1//''  
    int WINAPI _tWinMain (HINSTANCE hinstExe, 
    HINSTANCE hinstPrev, LPTSTR pszCmdLine, int nCffidShdw) { 
    HWND hwndDIPS; 
    HWND hwndLV; 
    MSG msg; 
    TCHAR cWhatToDo: 
    ChWARNIFUNICODEUNDERWIN95(); 
    //         
    CharUpperBuff(pszCmdLine, 1); 
    cWhatToDo = pszCmdLine[0]; 
    if ((cWhatToOo != _TEXT('S')) && (cWhatToDo != __TEXT('R'))) { 
    //     ;   
    cWhatToDo = 0; 
    \ 
    if (cWhatToDo == 0) { 
    //     : 
    //      
    switch (DialogBox(hinstExe, MAKEINTRESOURCE(IDD_DIPS), NULL, Dlg_Proc)) { 
    case IDC_SAVE: 
    cWhatToDo = __TEXT('S'); 
    break; 
    case IDC_RESTORE: 
    cWhatToDo = __TEXT('R'); 
    break; 
    } 
    if (cWhatToDo == 0) { 
    //      
    ret'jrn(O): 

    . . . 

    _____________________  18.     609 


    . 18-2 () 

    II  Desktop ListView - ""   
    hwndLV = GetFirstChild( 
    GetFirstChild(FindWindow(__TEXT("progMan"), NULL))); 
    chASSERT(IsWindow(hwndLV)); 
    
    //  ,   DLL    
    //  Explorer.       
    // .    ,  ,  . 
    chVERIFY(SetDIPSHook( 
    GetWindowThreadProcessId(hwndLV, NULL))): 
    //     DIPS 
    GetMessage(&msg, NULL, 0, 0); 
    //      
    hwndDIPS = FindWindow(NULL, __TEXT("Richter DIPS")): 
    // ,      
    chASSERT(IsWindow(hwndDIPS)); 
    //   DIPS,       
    // ,    :     
    SendMessage(hwndDIPS, WM_APP, (WPARAM) hwndLV, (cWhatToDo == __TEXT('S'))); 
    
    //   DIPS   ,  
    // PostMessage  SendMessage,     
    //    . 
    SendMessage(hwndDIPS, WM_CLOSE, , ); 
    
    // ,     
    chASSERT(!IsWindow(hwndDIPS)): 
    //         DIPS 
    //     Explorer 
    SetDIPSHook(O); 
    return(O); 
    } 
    ///////////////////    ////////// ///////////I///////'/// 


    610 _____________________________Windows   


    . 18^2 () 

    DIPSLIB.C 
    /****,,,.,**,**,,*,*****..*.,...,,.*.,...,*...,..,*,..*,,**.,**,,,..***,,* 
    : DIPSLib.G 
    : Copyright  1996-1997,   (Jeffrey Richter) 
    
    #include "..\CmnHdr.H"              /* .   */ 
    fflnclude <Wlndows.H> 
    include <WindowsX.H> 
    #include <CommCtrl.H> 
    ftdefine DIPSLIBAPI __declspec(dllexport) 
    #include "DIPSLib.H" 
    include "Resource,H" 
    //////////////       - 11     '   1/.1-111.1//..,,11,1.'.,1,1/,,//.//////,/////7//// 
    ftifdef _DEBUG 
    //     
    void ForceDebugBreak() { 
    __try { DebugBreakO: } 
    except(UnhandledExcept ionFilte( 
    GfitFxceptionInformationO)) { 
    ) 
    #else 
    ffdefine ForceDebugBreakO 
    #endlf 
    "7//////////////////    '.   '7 ..'//1/ ;/, '.// 77/,.7, ,,//,,/ 
    / /   
    LRESULT WINAPI GetMsgProc (int nCode, WPARAM wParam, LPARAM IParam); 
    BOOL WINAPI DIPS_DlgProc(HWND hwnd. UINT uMsg, WPARAM wParam, LPARAM IParam); 
    
//////////////////////////////////////////7/////////////////////////////////7.  
    
    //      g_hhook    
    //  Shared,   ,       
    //      
    ftpragma data_seg("Shared") 
     g_hhook = NULL; 
    DWORD g_dwThreadIdDIPS = 0; 
    #pragma data_seg() 

    . . . 

    _____________________ 18.     611 


    . 18-2 () 

    / I  ,    Shared    
    //  ,   " " 
    ffpragma coniment(linker, "/section:Shared, rws") 
    
    // -  
    HINSTANCE g hinstDll = NULL: 
    ///////////////////////////////////////////////////////
    BOOL WINAPI DllMain (HINSTANCE hinstDll. DWORD fdwReason, LPVOID fImpLoad) { 
    switch (fdwReason) { 
    case DLL_PROCESS_ATTACH: 
    //  DLL      
    g_hinstDll = hinstDll; 
    break; 
    case DLL_THREAD_ATTACH: 
    //      
    break; 
    case DLL_THREAD_OETACH: 
    //    
    break: 
    case DLL_PROCESS_DETACH; 
    //    DLL   
    //   
    break: 
    } 
    return(TRUE); 
    \ 
    i 
     //////////////////////////////////////////////
    ROOL WINAPI SetDIPSHook(DWORD dwThreadId) { 
    BOOL fOk = FALSE; 
    if (dwThreadId != 0) { 
    // ,      
    chASSERT(g_hhook == NULL); 
    
    //      , 
    //        GetMsgProc 
    //      
    g_dwThreadIdDIPS = GetCurrentThreadId(); 

    . . . 

    612 ______________________________Windows   


    . 18-2 () 

    II      
    gnhook = SetWindowsHookEx(WH_GETMESSAGE, GetMsgProc, 
    g_hinstDll, dwThreadId); 
    fOk = (g_nhook != NULL): 
    if (fOk) { 
    //  ;     
    // ,     
    fOk = PostThreadMessage(dwThreadId, WM_NULL, , ): 
    } 
    } else { 
    // ,     
    chASSERT(g_hhook != NULL); 
    fOk = UnnookWlndowsHookEx(g_hhook); 
    g_hnook = NULL; 
    } 
    return(fOk); 
    \ 
    /////////////////////////////////////////////////////////////////////////////// 
    LRESULT WINAPI GetMsgProc (int nCode, WPARAM wParam, LPARAM IParam) { 
    static BOOL fFirstTime = TRUE;                       '' 
    if (fFirstTime) { 
    // DLL    
    fFirstTime = FALSE; 
    //   ,    
    //  ,      DLL 
    // ForceDebugBreakO: 
    //    DIPS,  
    //   
    CreateDialog(g_hinstDll, MAKEINTRESOURCE(IDD_DIPS), NULL, DIPS_DlgProc): 
    //   DIPS,    
    //      
    PostThreadMessage(g_dwThreadIdDIPS, WM_NULL, , ); 
    } 
    return(CallNextHookEx(g_hhook, nCode, wParam, IParam)); 
    } 
    ////////////////////////////////////////////////////////

    . . . 

    _____________________ 18.     613 


    . 18-2 () 

    void DIPS_OnClose(HWND hwnd) { 
    DestroyWindow(hwnd); 
    } 
    //////////////////////////////////
    static const TCHAR g_szReg3ubKey[] = 
    TEXT("Software\\Richter\\Desktop Item Position Saver");                    
    ///////////////////////////////////////////
    void SaveListViewItemPositions(HWND hwndLV) { 
    int nitem, nMaxItems = ListView_GetItemCount(hwndLV); 
    HKEY hkey; 
    DWORD dwDisposition; 
    //   ,       
    LONG I = RegDeleteKey(HKEY_CURRENT_USER, g_szRegSubKey); 
    
    //     
    1 = RegCreateKeyEx(RKEY_CURRENT_USER, g_szReg3ubKey, 
    , NULL, REG_OPTION_NON_VOLATILE, KEY_SET_VALUE, 
    NULL, &hkey, &dwDisposition); 
    chASSERT(l == ERROR_SUCCESS); 
    for (nitem = 0; nitem < nMaxItems; nltem++) { 
    TCHAR szName[_MAX_PATH]; 
    POINT pt;                                                               : 
    //         
    ListView_GetItemText(hwndLV. nitem, 0. szName, chDIMOF(szName)): 
    ListView_GetItemPosition(hwndLV, nitem, &pt); 
    //      
    1 = RegSetValueEx(hkey, szName. 0, REG_BINARY, (PBYTE) &pt, sizeof(pt)); 
    chASSERT(l == ERROR_SUCCESS); 
    } 
    RegCloseKey(hkey); 
    } 
    1111111111111111/lllllllllllllllllllllllllllllllllllltllllllllllltlllllllllllll 
    void RestoreListViewItemPositions(HWND hwndLV) { 
    HKEY hkey: 
    LONG I = RegOpenKeyEx(HKEY_CURRENT_USER, g_szReg3ubKey, 
    0, KEY_QUERY_VALUE, &hkey); 
    if (1 == ERROR_SUCCESS) { 
    int nindex; 

    . . . 

    614 ______________________________Windows   


    . 18-2 () 
    
    II       
    //  (AutoArrange),  
    //   
    DWORD dwStyle = GetWindowStyle(nwndLV); 
    if (dwStyle & LVS_AUTOARRANGE) 
    SetWindowLong(hwndLV, GWL_STYLE, dwStyle & ~LVS_AUTOARRANGE); 
    I = NO.ERROR; 
    
    for (nindex =0; 1 '.= ERROR_NO_MORE_ITEMS; nlndex++) { 
    TCHAR szName[_MAX_PATH]; 
    POINT pt; 
    LV_FINDINFO Ivfi; 
    int cbValueName = chOIMOF(szName); 
    int cbData = sizeof(pt), nitem; 
    DWORD dwType; 
    //     
    
    1 = RegEnumValue(hkey, nindex, szName, &cbValueName, 
    NULL, &dwType, (PBYTE) &pt, &cbData); 
    
    if (i == ERROR_NO_MORE_ITEMS) 
    continue; 
    
    if ((dwType == REG_BINARY) && (cbData == sizeof(pt))) { 
    //     ,   
    //     
    Ivfi.flags = LVFI_STRING; 
    Ivfi.psz = szName: 
    nitem = ListView_FindItem(hwndLV, -1, &lvfi); 
    if (nitem != -1) { 
    //  ;    
    ListView_SetItemPosition(hwndLV, nitem, pt.x, pt.y); 
    } 
    } 
    i 
    
    II     , 
    //   
    SetWindowLong(hwndLV, GWL_STYLE, dwStyle): 
    RegCloseKey(hkey): 
    ////////////////////////////////
    BOOL WINAPI DIPS_DlgProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM IParam) { 
    switch (uMsg) { 
    chHANDLE_DLGMSG(hwnd, WM_CLOSE, DIPS_OnClose); 
    case WM_APP: 

    . . . 

    _____________________ 18.     615 


    . 18-2 () 

    II   ,    
    //  ,      DLL 
    // ForceDebugBreakO; 
    if (IParam) 
    Save ListVlewItemPositions((HWND) wParam); 
    else 
    RestoreListViewItemPositlons((HWND) wParam); 
    break; 
    i i 
    return(FALSE); 
    1111111111111/11111111111111111111   ///////////////////////////////// 
    DIPSL1B.H 
    : DIPSLib.H 
    : Copyright  1996-1997,   (Jeffrey Richter) 
    #if !defined(DIPSLIBAPI) 
    ffdefine DIPSLIBAPI __declspec(dllimport) 
    ftfindif 
    //////////////////////////////
    /I    
    DIPSLIBAPI BOOL WINAPI SetDIPSHook(DWORD dwThreadId): 
    1111111111111/11111111111111111/11   ///////////////////////////////// 


     DLL     

       DLL    ,   . 
     Win32: , ,  
,   ,     
Unicode. (    -   ,   
  .)  DLL    
        ,  
    ,     .  
   ,         
 . ,   ,      
 CreateThread ( 4)    ( 7). 

    616 ______________________________Windows   


      DLL 

       ,  LoadLibrary    
     ,   
 : 

    HINSTANCE LoadLibrary(LPCTSTR IpszLibFile); 
        WINBASE.H,  ,   LoadLibrary 
   : 
    HINSTANCE WINAPI LoadLibraryA(LPCSTR IpLibFileName); 
    HINSTANCE WINAPI LoadLibraryW(LPCWSTR IpLibFileName); 
    #ifdef UNICODE 
    ffdefine LoadLibrary LoadLibraryW 
    Seise 
    Sdefine LpadLibrary LoadLibraryA 
    Sendif // UNICODE 

       2  LoadLibrary. LoadLibraryA  
LoadLibraryW.      .   
    ANSI-,  LoadLibraryA (   
 ANSI);        Unicode  
  LoadLibraryW ( W   wide).   
  LoadLibrary   LoadLibraryA. 

    \/!32-,     

       ,          
.       DLL    
 ,    \32-,   
   .   ,   
    .     
Microsoft   ,   Win32  
 .       \32-,   
     . 

    \/32- 
                 

    CreateProcess                 . 
    FlushInstructionCache           . 
    VirtualProtectEx              ,  
 . 
    VirtualQueryEx               , 
  . 
    VirtualAllocEx               Windows NT 4,   
    /   . 
    VirtualFreeEx               Windows NT 4,  
     /    . 
    GetProcessAffinityMask      ,     
 . 
    GetProcess Times                . 

    . . . 

    _____________________ 18.     617 


     

    ^32- 
                 

    GetProcessWorkingSetSize         
   . 
    SetProcessWorkingSetSize        
    . 
    TerminateProcess             . 
    GetExitCodeProcess             . 
    CreateRemoteThread          ,  , 
    ReadProcessMemory             
  . 
    WriteProcessMemory          ,   
  . 
    GetPriorityClass                . 
    SetPriorityClass                 . 
    WaitForInputIdle            ,      
  . 

    Win32-4)ym<UMM 
                   

    SetThreadAffinityMask      ,     
 . 
    GetThreadPriority             . 
    SetThreadPriority              . 
    GetThreadTimes               . 
    Terminate Thread             . 
    GetExitCode Thread             . 
    GetThreadSelectorEntry           
  (     86). 
    GetThreadContext               . 
    SetThreadContext               . 
    ResumeThread                (suspend count) 
   1. 
    SuspendThread                  1. 
      DLL        
    .    . 
     CreateRemoteThread 
        ,     : 
    HANDLE CreateRemoteThread(HANDLE hProcess, LPSECURITY_ATTRIBUTES Ipsa, 
    DWORD cbStack, LPTHREAD_START_ROUTINE IpStartAddr, LPVOID IpvThreadParm, 
DWORD fdwCreate, LPDWORD IpIDThread); 
      CreateThread,     hProcess, 
 ,     .  
IpStartAddr  

    618 ______________________________Windows   

      .  , ,    
           . 

    VWINDOWS/ 
     Windows NT    CreateThread   
 CreateR emoteThread: 

    HANDLE CreateThread(LPSECURITY_ATTRIBUTES Ipsa, DWORD cbStack, 
    LPTHREAD_START_ROUTINE IpStartAddr, LPVOID IpvThreadParm, 
    DWORD fdwCreate, LPDWORD IpIDThread) { 
    return (CreateRemoteThr-ead(GetCurrentProcess(), Ipsa, cbStack, IpStartAddr, 
    IpvThreadParm, fdwCreate, IpIDThread)); 
    } 


    XwiNDowsy 
     Windows 95  CreateRemoteThread     FALSE; 
  GetLastError   ERROR_CALL_NOT_IMPLEMENTED. ( 
CreateThread,      ,  
.)       DLL  Windows 95  . 

     GetJhreadContext  SetJhreadContext 

     Win32 API   ,    ,  CONTEXT. 
         86.  
   5 .  CONTEXT_CONTROL   
 :  ,  ,     
. (   86,        
 ,  MIPS  Alpha       
.)  CONTEXT_INTEGER   , 
CONTEXT_FLOATING_POINT     , CONTEXT_SEGMENTS  
  (  86), a CONTEXT_DEBUG_REGISTERS  , 
   (  86). typedef struct .CONTEXT { 
    / 
    // ,    CONTEXT. 
    // 
    
    //       ,  , 
    //   (  ),   
    //  .      
    //   ,     ,  
    //   . 
    // 
    
    //       IN OUT   
    //  ,     ,   
    //   .     
    //    OUT. 
    // 
    UWORO ContextFlag3: 

    ____________________ 18.      619 
    //   /,   ContextFlags  
    //  GONTEXT_DEBUG_REGISTERS. ,  CONTEXT_DEBUG_REGISTERS 
    //    CONTEXT_FULL. 
    // 
    DWORD DrO; 
    DWORD Dr1; 
    DWORD Dr2; 
    DWORD Dr3: 
    DWORD Dr6; 
    DWORD Dr7: 
    // 
    //   /,   ContextFlags 
    //   CONTEXT_FLOATING_POINT, 
    // 
    FLOATING_SAVE_AREA FloatSave; 
    /7 
    //   /,   ContextFlags 
    //   CONTEXT SEGMENTS. 
    // 
    DWORD SegGs; 
    DWORD SegFs; 
    DWORD SegEs: 
    DWORD SegDs: 
    // 
    //   /,   ContextFlags 
    //   CONTEXT_INTEGER. 
    // 
    DWORD Edi; 
    DWORD Esl; 
    DWORD Ebx; 
    DWORD Edx; 
    DWORD Ecx; 
    DWORD Eax; 
    // 
    //   /,   ContextFlags 
    //   CONTEXT_CONTROL. 
    // 
    DWORD Ebp; 
    DWORD Eip: 
    DWORD SegCs;     //   
    DWORD EFlags;    //   
    DWORD Esp; 
    DWORD SegSs; 
    } CONTEXT; 


    620 ______________________________Windows   

       CONTEXT,    
-  ,  Context flags.     
 ,    ,    
GetThreadContext,      . ,  
     ,  - : 

    //   CONTEXT 
    CONTEXT Context; 
    
    //  ,       
    Context.ContextFlags = CONTEXT_CONTROL; 
    
    //   ,    , 
    //    
    GetThreadContext(hThread, &Context): 
    
    //      CONTEXT, 
    //   ,   
    //   
    
      GetThreadContext    ContextFlags. 
    ,    , 
  ContextFlags : 

    //  ,    
    //     
    Context,ContextFlags = CONTEXT_CONTROL ; CONTEXT_INTEGER; 

       ,       
 (. . ,   Microsoft,  ): 

    //  ,    
    //    
    Context.ContextFlags = CONTEXT_FULL; 
    CONTEXT_FULL    WINNT.H,    : 
          CONTEXT_FULL 
    &6            CONTEXT_CONTROL ! CONTEXTJNTEGER ! CONTEXT_SEGMENTS 
    MIPS           CONTEXT_CONTROL ! CONTEXT_FLOATING_POINT ! CONTEXTJNTEGER ! 
    CONTEXT_EXTENDED_INTEGER 
    Alpha           CONTEXT_CONTROL ! CONTEXT_FLOATING_POINT : CONTEXTJNTEGER 
    PowerPC         CONTEXT_CONTROL ! CONTEXT_FLOATING_POINT ! CONTEXTJNTEGER 

       GetThreadContext      
  ,  ,       .  
     CONTEXT,  
       : 

                   

    86                CONTEXT.Eip          CONTEXT.Esp 
    MIPS              CONTEXT.Fir          CONTEXT.IntSp 
    Alpha              CONTEXT.Fir          CONTEXT.IntSp 
    PowerPC           CONTEXT.Iar          CONTEXT.GprI 


    __________________ 18.     621 


    /*\ 
      PowerPC   (Gpri)   ,  
   .   PowerPC   ContextFlags 
 CONTEXT    CONTEXTJNTEGER,   CONTEXT_CONTROL. 
       CONTEXT    . 
,      ,   .  
  SetThreadContext     : 

    BOOL SetThreadContext(HANDLE hThread, CONST CONTEXT *lpContext); 

       SetThreadContext   ContextFlags, 
  : 

    CONTEXT Context; 
    
    //   
    SuspendThread(hThread): 
    
    //      
    Context,ContextFlags = CONTEXT_CONTROL: 
    GetThreadContext(hThread, &Context); 
    //      ; 
    
    //      000010000 
    ftif defined(_ALPHA_) 
    Context.Fir = 000010000; 
    
    #elif defined(_MIPS_) 
    Context.Fir- = 000010000: 
    
    ffelif defined(_X86_) 
    Context.Eip = 000010000; 
    
    #elif defined(_PPC_) 
    Context.lar = 000010000; 
    Seise 
    #error Module contains CPU-specific code; modify and recompile. 
    #endif 
    
    //     ; ContextFlags 
    //   ,      
    Context.ControlFlags = CONTEXT_CONTROL; 
    SetThreadContext(hThread, &Context); 
    
    //   ;     000010000 
    ResumeThread(hThread); 


     Virtua/QueryEx  VirtualProtectEx 

     VirtualQueryEx      : 

    DWORD VirtualQueryEx(HANDLE hProcess, LPCVOID IpvAddress, 
    PMEMORY_BASIC_INFORMATION pmbiBuffer, DWORD cbLength); 

        VirtualQuery (.  7),    
 hProcess,   ,    
    . 

    622 ______________________________Windows   

    VirtualProtectEx        
   ,   : 

    DWORD VirtualProtectEx(HANDLE hProcess, LPVOID IpvAddress. 
    DWORD cbSize, DWORD fdwNewPr-otect, LPDWORD pfdwOldProtect); 

       VirtualProtect (.  7)     
  hProcess. 

     VirtualAHocEx  VirtualFreeEx 

       Windows NT 4. VirtualAllocEx   
  /     : 

    LPVOID VirtualAllocEx(HANDLE hProcess, LPVOID IpAddress. DWORD dwSize, 
    DWORD flAllocatiohType, DWORD flProtect); 

    a VirtualFreeEx       / 
   : 

    BOOL VirtualFreeEx(HANDLE hProcess, LPVOID IpAddress. 
    DWORD dwSize, DWORD dwFreeType): 

       VirtualAlloc  VirtualFree (.  7). 
   ,        
   . 

     ReadProcessMemory  Write ProcessMemory 

             
      ,  : 

    BOOL ReadProcessMemory(HANDLE hProcess, LPVOID IpBaseAddress, LPVOID IpBuffer, 
    DWORD cbRead, LPDWORD IpNumberOfBytesRead); 
    BOOL WriteProcessMemory(HANDLE hProcess, LPVOID IpBaseAddress, LPVOID IpBuffer, 
    DWORD cbWrlte, LPDWORD IpNuniberOfBytesWritten); 

     hProcess   , IpBaseAddress 
        , 
IpBuffer       , cbRead  cbWrite  
 ,   ,     
IpNumberOfBytesRead  IpNumberOfBytes Written,    
  . 

    ,  DLL      

       (-!)     DLL   
.     :  LoadLibrary  
   DLL    ,  
   .      .  , 
  LoadLibrary    . 
          .   
   ,     ,    . 
18-5.       ,   , 
       InjectLib. 

    _____________________  18.     623 

     0:      
     ,  ,   : 

    HANDLE hProcessRemote', 
    DWORD dwThreadId: 
    HINSTANCE hinstKml = GetModuleHandle(__TEXT("Kernel32")); 
    CreateRemoteTriread(hProcessRernote, NULL, 0, 
    (LPTHREAD_START_ROUTINE) GetProcAddress( hinstKml, "LoadLibraryA"), 
    "C:\\MYLIB.DLL", 0, &dwThreadId): 

      CreateRemote Thread    ,    , 
  ,      .     
   .        
LoadLibraryA.  ,     32-   
 ANSI-    DLL. LoadLibraryA  DLL  
  ,   ,   
.   DLL      StartOfThread,  
   . , MYLIB.DLL       
  ,        
 ,     . 
      ,      ?    , 
  C:\\MYLIB.DLL      
.      (   ) 
 .    LoadLibraryA,  ,    
      ,     
.          ;  
       ,  
  . -,     . , ? 
     ,         
 ! 
       ,    ,  
DLL,     .  ?    
 . 
     , ,   ,      
LoadLibraryA  GetProcAddress  ,   : 

    CreateRenioteThread(hProcessRemote, NULL, 0, LoadLibraryA, 
"C:\\MYLIB.DLL", 0, &dwThreadId); 

      .  ,      
 Win32-nporpaMMbi,    (jump table),  
    (thunks)   . ,   
 , , LoadLibraryA,       
     -  DLL-.     
    .   ,  
   -  DLL-   . 
         LoadLibraryA   CreateRemoteThread, 
       LoadLibraryA   
.          
      ,      
  .       LoadLibraryA  
            GetProcAddress. 
     CreateRemoteThread ,   KERNEL32.DLL  
            
.     , ,    , 
    

    624 ________________________________ Windows   

           .    ,    
.  ,   ,    : 

    void __cdecl main(void) { 
    > 

       PVIEW.EXE,  ,     
  NTDLL.DLL  KERNEL32.DLL     . 

     1:     

       InjectLib,     ,  
 .         CreateRemoteThread: 

    hThread = CreateRemoteThread(hProcess, NULL, 1024, 000000000, NULL, 
CREATE_SUSPENDED, &dwThreadId); 

         ,    
  000000000.        
 .     CREATE_SUSPENDED,   ,  
     1       
 . 
        ,     .    
 GetThreadContext   ,      . 
      ,     WriteProcessMemory    DLL  
  .        
       (  Intel 86),  
  : 

    mov   , <     DLL  > 
    push            ;     DLL   
    call   LoadLibraryA ;   LoadLibrary 
    push            ;    hinstDll  DLL (  ) 
    push            ;    hinstDll 
    call   FreeLlbrary ; hinstDll       
    call   ExitThread   ;  ,  hinstDll    

     ,     ,   
  ,    .    
WriteProcessMemory,         
(    DLL). 
        CONTEXT    ,  
         ,  
        (. . 18-3).   
SetThreadContext,      ,   
 . 

                                
( ) 
       DLL    | ^______   =   
 DLL 
    -^   =    
                                                       
(   ) 
       

    . 18-3. ,    ,   
     


    _________________  18.     625 

        ResumeThread,      
   , . .   DLL,     
 . 
    -      . -,   
  ExitThread,      . :  
     StartOfThread (.  4). 
        ,  StartOfThread 
 .  StartOfThread   ,     
  , StartOfThread     . 
,       RET ( Intel x86)  
   ,   . ,    
 ,    ExitThread. 
    -,       , 
LoadLibrary A  NULL.       NULL    
 freeLibrary. ,      
   0   FreeLibrary,      0.   
    ,        
       .  , FreeLibrary 
,      hinstDll,    FALSE, 
   . 
    -,   StartOfThread ,  SEH-, 
    ,  .  , 
    . ,    .   
,      LoadLibraryA, FreeLibrary  
ExitThreacP.    12:       DllMain 
(   )   fdwReason,  
DLL_PROCESS_ATTACH  DLL_PROCESS_DETACH.      
,    ,    
. ,          
  SEH-,     .    SEH 
       . 
     ,  ,        
 .  -        
,       .  ,   
        .  
,      MIPS     Alpha,    
 ,  -   -    
  -. 
    ,        ,   
         - 
.     (, ,  ),   
  (-   )  -  ,  
  Intel  MIPS.    2. 

     2: A/JocProcessMemory  Create Thread 

        : 
    1.        . 
    2.          
   ( ). 
    3.         
INJLIBINFO,    DLL    . 
    4.  CreateRemote Thread,      
     IpStartAddr,    INJLIBINFO 
  IpvThreadParm. 
    5.    . 
    6.  ,    . 

    626 ______________________________Windows   

        .   ,    
      . 
          ,     
  \32-: VirtualAllocEx  VirtualFreeEx.  ,   Win32 
API  VirtualQueryEx,      
   ,  VirtualProtectEx,   
        .   
,     VirtualAllocEx  VirtualFreeEx.   !   
   .      -  
      !    ,  
        ,  !   
  ,        
 . 

    /\ 
     Windows NT 4  VirtualAllocEx  VirtualFreeEx - , 
    DLL.   ,      g 
Windows NT 3.51 (    ),  ,    
   VirtualAllocEx  VirtualFreeEx.    
  Windows NT 4 (   ),    
AllocProcessMemory  FreeProcessMemory (. )     
VirtualAllocEx  VirtualFreeEx . 

        ,      
        . 
   PROCMEM.C (.   . 18-4),    
 : AllocProcessMemory  FreeProcessMemory. 
      FreeProcessMemory. PVOID AllocProcessMemory(HANDLE 
hProcess, DWORD dwNumBytes); 
        ,       
  .  hProcess   
, a dwNumBytes    .   
         
 NULL      .    .   
 CreateRemoteThread: 

    HINSTANCE hinstKrn! = GetModuleHandle(__TEXT("Kernel32")): 
    hThread = CreateRemoteThread(hProcess, NULL, dwNumBytes + sizeof(HANDLE), 
    (LPTHREAD_START_ROUTINE)GetProcAddress(hinstKrnl, "ExitThread"), 
    0, CREATE_SUSPENDED, &dwThreadId); 

     ,          
.      CreateRemoteThread   
 ,      (  , 
    AllocProcessMemory,     
HANDLE).  ,    ,      
 ;        . 
      ,       ,  
   ExitThread.  ,    
 ExitThread,   0.  ,    
    ,   .    
    ,     CreateRemoteThread  
CREATE_SUSPENDED    ,     ;  
    ,     . 
  ,       
dwThreadId      . 

    ____________________ 18.     627 

        ExitThreacP.      : 

    hThread = CreateRemoteThread(hProcess, NULL, dwNumBytes + sizeof(HANDLE), 
    000000000. 0, CREATE_SUSPENDED, &dwThreadId); 

      ,        
 000000000,       ,  
    .      
        : 

    TerrriinateThread(hThread, ): 

    , TerminateThread    , , ,  
 ,     (.   
TerminateThread   4). ,    , 
     ,    
       ExitThread. 
    ,   ,  ,     
     .   : 

    CONTEXT Context; 
    Context.ContextFlags = CONTEXT_CONTROL : CONTEXT_INTEGER; 
    GetThreadContext(hThread, &Context): 
    //       -   

    GetThreadContext     ,  
  .  CONTEXT     
 ,     ,   
32-   .     4   
 .     -  ,   
    4         
.    4  ( 32- )   
       32-   . 
            ,   
  STACKPTR,       
.      -  : 

    Sif defined(_X86_) 
    ftdefine STACKPTR(Context) ((Context).Esp) 
    #endif 
    (tif defined(_MIPS_) 
    ffdefine STACKPTR(Context) ((Context).IntSp) 
    ftendif 
    #if defined(_ALPHAJ 
    #define STACKPTR(Context) ((Context).IntSp) 
    Sendif 
    #if defined(_PPC_) 
    ffdefine STACKPTR(Context) ((Context). Gpr-l) 
    #endif 
    tfif !defined(STACKPTR) 
    #error Module contains CPU-specific code; modify and recompile. 
    Sendt f 


    628 ______________________________Windows   

        ,   STACKPTR.  ,   
,   #error.      
       ,   
 ,          . 
       ,   VirtualQueryEx: 

    MEMORY_BASIC_INFORMATION mbi: 
    LPVOID pvMem; 
    VirtualQueryEx(hProcess. (PDWORD) STACKPTR(Context) - 1, &mbi, sizeof(mbi)); 
    pvMem = (PVOID) mbi.BaseAddress; 

       ,  ,      
,   MEMORY_BASIC_INFORMATION  
.    BaseAddress,    , 
 , . .      . 
             ,    
  . ,       
   ResumeThread,    -   
 .        
AllocProcessMemory    HANDLE,     
  ,      . -,  
         
AllocProcessMemory. -,       
           
  FreeProcessMemory. 
             , 
     .    
   WriteProcessMemory. 

    f0k = WriteProcessMemory(hProcess. pvMem, ShThread, 
    sizeor(riThread), &dwNumBytesXrerred); 

              
   : 

    pvMem = (PVOID) ((PHANDLE) pvMem +1); 
    return(pvMem); 

        .      
 ,    FreeProcessMemory. 

    BOOL FreeProcessMemory(HANDLE hProcess, PVOID pvMem); 

           ,  
  AllocProcessMemory. ,   FreeProcessMemory,  
   ,  AllocProcessMemory   
 4   .    ,   
        ReadProcessMemory. 

    pvMem = (PVOID) ((PHANDLE) pvMem - 1); 
    f0k = ReadProcessMemory(hProcess, pvMem, &hTherad, 
    sizeof(hThread), &dwNumBytesXferred); 

        ,  ResumeThread: 

    ResumeThread(read); 
    CloseHandle(hThread); 

     ,     ExitThread   ,  
   .  ,     
CloseHandle,        
      AllocProcessMemory. 

    _____________________ 18.     629 


      ProcMem 

    AllocProcessMemory  FreeProcessMemory      
   .      PROCMEM. 
(.   . 18-4).  ,   ,   
  PROC.,    . 18-4.   
     TINJLIB  -,   
.      Windows NT 4 (    
),     ,       
 VirtualAllocEx  Virtual?. 

    PROCMEM.C 
    : . 
    : Copyright  1995-1997,   (Jeffrey Richter) 
    ftinclude "..\CmnHdr.H"              /* .   */ 
    include <windows.h> 
    ftinclude "ProcMem.H" 
    //////////////////////////////////////
    ftif defined(_X86_) 
    ftdefine STACKPTR(Context) ((Context).Esp) 
    ftendif 
    #lf defined(_MIPS_) 
    ffdefine STACKPTR(Context) ((Context),IntSp) 
    ftendif 
    ftif defined(_ALPHA_) 
    ffdefine STACKPTR(Context) ((Context).IntSp) 
    ftendif 
    ftif defined(_PPC_) 
    ftdefine STACKPTR(Context) ((Context).Gpr1) 
    ftendif 
    ftif !defined(STACKPTR) 
    (terror Module contains CPU-specific code; modify and recompile. 
    ftendif 
    ///////////////////////////////////
    PVOID AllocProcessMemory (HANDLE hProcess, DWORD dwNumBytes) { 
    CONTEXT Context; 
    DWORD dwThreadId, dwNuffiBytesXferred, dwError; 
    HANDLE hThread: 
    HINSTANCE hinstKrn! = GetModuleHandle(__TEXT("Kernel32")); 
    PVOID pvMem = NULL; 
    MEMORY_BASIC_INFORMATION mbi; 

    . . . 

    . 18-4.      ProcMem 

    630 ______________________________Windows   


    . 18-4 () 

    BOOL f0k = FALSE: //   
    __try { 
    hThread = CreateRemoteThread( 
    hProcess, 
    NULL,            //     
    dwNumBytes + sizeof(HANDLE), 
    
    //  ,    , 
    //  4     
    (LPTHREAD_START_ROUTINE) GetProcAddress(hinstKrnl, "ExitThread"), 
    //  ,     ; 
    //   ExitThread,     
    ,               // ,   , 
    // . .  ExitThread 
    CREATE_SUSPENDED,   // .     
    // ,    ,   
    //   . 
    &dwThreadId);       //    
    if (hThread == NULL) { 
    dwError = GetLastError(); //   
    __leave: 
    } 
    Context.ContextFlags = CONTEXT_CONTROL : CONTEXT_INTEGER; 
    if (!GetThreadContext(hThread, &Context)) 
    __leave; 
    
    //      
    if (sizeof(mbi) != VirtualQueryEx(hProcess, 
    (PDWORD) STACKPTR(Context) - 1. &mbi, sizeof(mbi))) 
    __leave: 
    //     
    //      
    pvMem = (PVOID) mbi.BaseAddress; 
    
    f0k = WriteProcessMemory(hProcess, pvMem, ShThread, 
    sizeof(hThread), &dwNumBytesXferred); 
    if (!f0k) 
    leave;                           ;.              ..   ...   .... 
    //         
    pvMem = (PVOID) ((PHANDLE) pvMem +1); 
    } 
    finally { 
    if CfOk) { 

    . . . 

    ____________________ 18.     631 


    . 18-4 () 

    if (hThread) { 
    ResumeThread(hThread); 
    CloseHandle(hThread); 
    } 
    i-ivMpm = HIJI I ' 
    } 
    return(pvMern); 
    //////////// //////////// ////////////// ///////////////.' 
    BOOL FreeProcessMemory (HANDLE hProcess, PVOID pvMem) { 
    BOOL fOk; 
    HANDLE hThread; 
    DWORD dwNumBytesXferred; 
    //        
    pvMem = (PVOID) ((PHANDLE) pvMem - 1); 
    
    f0k = ReadProcessMemory(hProcess, pvMem, &hThread, 
    sizeof(hThread), &dwNumBytesXferred); 
    if (fOk) { 
    if (ResumeThread(hThread) == Oxffffffff) { 
    
    //      
    // , - ,    
    //   ,   
    fOk = FALSE; 
    } 
    CloseHandle(hThread); 
    } 
    return(fOk); 
    i 
    //////////////////////////////////////////
    PROCMEM.H 
    : ProcMem.H 
    : Copyright  1995,   (Jeffrey Richter) 
    PVOID AllocProcessMemory (HANDLE hProcess. DWORD dwNumBytes); 
    BOOL FreeProcessMemory (HANDLE hProcess, PVOID pvMeni); 
    IIIIIIH/III I/IIII//I// /II/II/II/I   i /1 /111111 /11 i 11 /11 


    632 _____________________ _______ Windows   


     InjectLib 

     InjectLib (.   . 18-5)   DLL  
   .       
   TINJLIB  -,   .   
 ,    ,      
  .  ,      
  ThreadFunc   INJLIBINFO,    
 . 
       , ThreadFunc  LoadLibrary  
  .   -  
ThreadFunc  ,        (  
  ),      .  
         
       .    
        . 
     ThreadFunc,     ,   
         
 ,          
  . ,   ,   
 !   . 
     ,          
,          
,         . 
ThreadFunc         .  
           
  (  ),     . 
     ,        
    .  , ,   
      ,   
   (   ),   
.        ,    
       . 
        ,     - 
.         INJLIBINFO, 
    ThreadFunc .    3 : 

    typedef HINSTANCE (WINAPI *PROCLOADLIBRARY)(LPBYTE); 
    typedef BOOL (WINAPI *PROCFREELIBRARY)(HINSTANCE) 
    typedef struct { 
    PROCLOADLIBRARY fnLoadLibr-ary; 
    PROCFREELIBRARY fnFreeLibrary; 
    BYTE pbLibFile[MAX_PATH * sizeof(WCHAR)]; 
    } INJLIBINFO, *PINJLIBINFO; 

       , fnLoadLibrary,    
 LoadLibraryA,  LoadLibraryW (   ,   
  pbLibFile:  ANSI   Unicode).   fnFreeLibrary 
    FreeLibrary,     ( ANSI  
 Unicode),      DLL. 
         ThreadFunc    
 (   ,   AllocProcessMemory). 
ThreadFunc      LoadLibrary: 

    HINSTANCE hinstDH: 
    hinstDll = pInjLibInfo->fnLoadLibrary(pInjLibInfo->pbLibFile); 


    _____________________ 18.     633 

    ,      ,  DllMain  DLL  
  DLL_PROCESS_ATTACH.   HINSTANCE  DLL 
    hinstDll.       
   ThreadFunc  FreeLibrary. 

    if (hinstDll != NULL) { 
    pin]Liblnfo->fnFreeLibrary(hinstDll); 
    } 

      FreeLibrary ,   DllMain  
 DLL_PROCESS_DETACH. 
       ThreadFunc  HINSTANCE  DLL,   
 DLL    NULL.     
 .  ,   ,  
  ,       .  
    ,   GetExitCodeThread.  
, ,    , ,   
 DLL. 
         ThreadFunc    
 .          
 .    ThreadFunc    StartOfThread.  
, ,   , ThreadFunc     ExitThread 
      .  , SEH-, 
  ,      
 . 

     Injectiib, InjectLibA, InjectLibWw InjectLibWorA 

       ,    ThreadFunc  
   .       
 ,     2  :  ANSI   
Unicode.  ,   2  :   ANSI 
(InjectLibA),    Unicode (InjectLibW);  ,    
InjectLib,           , 
  UNICODE  . 

    BOOL InjectLibA (HANDLE hProcess, LPCSTR IpszLibFile); 
    BOOL InjectLibW (HANDLE hProcess, LPCWSTR IpszLibFile); 
    ftifdef UNICODE 
    (tdefine InjectLib InjectLibW 
    ffelse 
    Sdefine InjectLib InjectLibA 
    #endif // 'UNICODE 

            INJLIB.H (. . 18-5). 
     InjectLibA  InjectLibW  ,    
   InjectLibW'orA.    
,       INJLIB.C (. . 18-5).  
InjectLibW'orA,   : 
      ,     DLL; 
          DLL (     ANSI,    Unicode); 
      ,    IpszLibFile (TRUE  
Unicode,  FALSE  ANSI). 
    ,  InjectLibW'orA, ,    DLL 
  .  InjectLibA  InjectLibW    
 InjectLibWorA   . 

    634 ______________________________Windows   

    BOOL InjectLibA (HANDLE hProcess, LPCSTR IpszLibFile) { 
    return(InJectLibWor-A(hProcess, (LPBYTE) IpszLibFile, FALSE)); 
    } 
    BOOL InjectLibW (HANDLE hProcess, LPCWSTR IpszLibFile) { 
    return(InjectLibWorA(hProcess, (LPBYTE) IpszLibFile, TRUE)); 
    ( 

    ,    InjectLibWorA  DLL    
 ?        INJLIBINFO: 

    HINSTANCE hinstKrnI = GetModuleHandle(__TEXT("Kernel32")); 
    INJLIBINFO InjLibInfo; 
    InjLibInfo.fnLoadLibrary = (PROCLOADLIBRARY) GetProcAddress(hinstKrnl, 
    (fUnicode ? "LoadLibraryW" : "LoadLibraryA")); 
    InJLibInfo.fnFreeLibrary = (PROGFREELIBRARY) GetProcAddress(hinstKrnl, "FreeLibrary"); 
    InjLiblnfo,pbLibFile[0] = 0; //   
    if (fUnicode) 
    wcscpy((LPWSTR) In]LibInfo.pbLibFile, (LPCWSTR) pbLibFile); 
    else 
    strcpy((LPSTR) InjLibInfo.pbLibFile, (LPCSTR) pbLibFile); 

         ,    ,  
    LoadLibraryA ( LoadLibraryW) 
 FreeLibrary.    DLL    pbLibFile  
   INJLIBINFO. 
      ,   KERNEL32.DLL    
  ,          
  .    ,           
,   . 
        ,     
 .      ThreadFunc   
INJLIBINFO.  ,   ThreadFunc,  
           AfterThreadFunc. 

    const int cbCodeSize = ((LPBYTE) (DWORD) AfterThreadFunc - (LPBYTE) 
(DWORD) ThreadFunc); 

       ,      
AfterThreadFunc      ThreadFunc.   
 Intel, MIPS, Alpha  PowerPC,   Visual C++,  
 .   ,     Alpha (  
 ,   Windows NT)   
      .  ,    
  Windows NT    ThreadFunc   
AfterThreadFunc  ,       . 
    ,       Windows NT,   
  ,      .  
    ThreadFunc    BeforeThreadFunc.  
  Before ThreadFunc   AfterThreadFunc    
ThreadFunc   . ,  ,    
-       , , 
,  . 
    ,       ThreadFunc,     , 
    INJLIBINFO: 

    const DWORD cbMemSize = CbCodeSize + sizeof(InjLibInfo) + 3: 


    _____________________ 18.     635 

     ,    3   ?  - ,   
       32- . ,  
 ThreadFunc  65 ,     INJLIBINFO 
   ,    65- .   
ThreadFunc     ,   
 -   .   86  
  ,       , 
  RISC- , , .  INJLIBINFO 
  ThreadFunc,     .    
   ,   ,      
  3-     . 
             
 AllocProcessMemory. 

    pdwCodeRemote = (PDWORD) AllocProcessMemory(hProcess, cbMemSize); 

         ,   
     PAGEJREADWRITE.  ,  
      ,     
     .    
 ,        . 
    VirtualProtectEx: 

    f0k = VirtualProtectEx(hProcess, pdwCodeRemote, cbMemSize, 
PAGE_EXECUTE_READWRITE, &dw01dProtect); 

        ,     .  
,   ,         
   86, MIPS  Alpha.    ?   , 
    ,   ,    
 , ? ,   . Win32    
 ,       .    , 
 86, Alpha, MIPS  PowerPC     . 
 :    , ,   .  
             
VirtualProtectEx. 
        ThreadFunc   INJLIBINFO  , 
     : 

    f0k = WriteProcessMemory(hProcess, pdwCodeRemote, 
    (LPVOID) (DWORD) ThreadFunc, cbCodeSize, &dwNumBytesXferred); 
    
    //     32-  
    PINJLIBINFO pInjLibInroRemote = (PINJLIBINFO) 
    (pdwCodeRemote + ((cbCodeSize + 4) & ~3)); 
    f0k = WriteProcessMemory(hProcess, pInjLibInfoRemote, &InjLibInfo, 
sizeof(InjLibInfo), &dwNumBytesXferred); 

    ,     .      
,     ThreadFunc,    
 INJLIBINFO.         
    ,      
   ,       DLL   : 

    HANDLE hThread = CreateRemo1:eThread(hProcess, NULL, 0, 
    (LPTHREAD_START_ROUTINE) (DWORD) pdwCodeRemote, 
    pInjLibInfoRemote, 0, &dwThreadId); 
    WaitForSingleOb]ect(hThread, INFINITE): 


    636 ______________________________Windows   

       ,      . 
   HINSTANCE ,  .  HINSTANCE  
NULL,  ,   DLL  ;   
InjectLibWorA  FALSE (    TRUE).     
   ,      ,  , 
     ,  : 

    GetExltCodeThread(hThread, (PDWORD) &hinstDllRemote); 
    CloseHandle(hTriread); 
    FreeProcessMemory(hProcess, pdwCodeRemote); 
    return (hinstDIIRemote != NULL): 
    INJLIB.C 
    : InjLib.C 
    : Copyright  1995-1997,   (Jeffrey Richter) 
    
    ((include "..\CmnHdr.H"               /* .   */ 
    ((include <windows,h> 
    ((include "ProcMeiri. H" 
    {(include "InjLib.H" 
    /////////////////////////////////////////////////////////////////////////////// 
    typedef HINSTANCE (WINAPI *PROCLOADLIBRARY)(LPBYTE): 
    typedef BOOL (WINAPI *PROCFREELIBRARY)(HINSTANCE); 
    typedef struct { 
    PROCLOA'DLIBRARY fnLoadLibrary: 
    PROCFREELIBRARY fnFreeLibrary: 
    BYTE pbLlbFile[MAX_PATH * sizeof(WCHAR)]; 
    } INJLIBINFO, *PINJLIBINFO; 
    /////////////////////////////////////////////////////////////////////////////// 
    
    / I       
    pragma check_stack (off) 
    
    static DWORD WINAPI ThreadFunc (PINJLIBINFO pInjLibInfo) { 
    //   ,   , 
    //     
    HINSTANCE hinstDll: 
    
    //  LoadLibrary(A/W)   DLL 
    hinstDll = pInjLibInfo->fnLoadLibrary(pInjLibInfo->pbLibFile); 
    
    //  LoadLibrary    DLL  
    //       DllMain 
    //     fdwReason,  DLL_PROCESS_ATTACH, 

    . . . 

    . 18-5.   InjectLib 

    _____________________ 18.     637 


    . 18-5 () 

    II     DLL     . 
    //    DllMain     LoadLibrary 
    // HINSTANCE  DLL.     FreeLibrary,  
    //   HINSTANCE,   DLL. 
    
    //  DLL       DllMain 
    // (DLL_PROCESS_ATTACH)  FALSE, hinstDll   NULL. 
    
    //    ,  . 
    if (hinstDll != NULL) { 
    
    //  FreeLibrary    DllMain  
    //   DLL_PROCESS_DETACH; DLL     
    pinjLlbInfo->fnFreeLlb(hinstDll); 
    
    //    -  DLL 
    return((DWORD) hinstDll): 
    \ i 
    ,11./7//////7//////////////////7//////1//7/7///7//////////////////'/////////'////1//1.1 
    //        ThreadFunc: 
    // ThreadFuncCodeSizeInBytes = (PBYTE) AfterThreadFunc - (PBYTE) ThreadFunc 
    static void AfterThreadFunc (void) { 
    } 
    ffpragma check_stack 
    ////////////////////////////////////////////////,///7/,//,/////////,/////////////// 
    static BOOL InjectLlbWorA (HANDLE hProcess, 
    const BYTE * const pbLibFile, BOOL fUnicode) { 
    
    // HINSTANCE  Kernel32.DLL     
    //  LoadLibraryA ( LoadLibraryW)  FreeLibrary 
    HINSTANCE hinstKrnI = GetModuleHandle(__TEXT("Kernel32")): 
    INJLIBINFO InjLibInfo; 
    
    //    ,     
    PDWORD pdwCodeRemote = NULL; 
    //       ThreadFunc 
    (tifndef _PPC_ 
    const int cbCodeSize = ((LPBYTE) (DWORD) 
    AfterThreadFunc - (LPBYTE) (DWORD) ThreadFunc): 
    seise 
    // :  PowerPC    
    // 32-  (32-bit immediates).   VC++ 
    //  PowerPC       , 
    //     .    
    OVf. OU'tl. CHJp. 

    638 _____________________________- Windows   


    . 18-5 () 

    //        . 
    // ,    ,   , 
    //    . 
    const int cbCodeSize = ((LPBYTE) *(PDWORD) 
    AfterThreadFunc - (LPBYTE) *(PDWORD) ThreadFunc); 
    tfenni f 
    .//    ,    
    //  INJLIBINFO 
    PINJLIBINFO pInJLibInfoRemote = NULL; 
    
    //  ,     
    DWORD dwNumBytesXferred = 0: 
    
    //    ,  
    //   ThreadFunc 
    DWORD dwThreadId = 0; 
    const DWORD cbMemSize = cbCodeSize + sizeof(InjLibInfo) + 3; 
    HANDLE hThread = NULL; 
    HINSTANCE hinstDnRemote - NULL' 
    BOOL fOk = FALSE; 
    DWORD dwOldProtect; 
    //   INJLIBINFO,     
    //     
    InjLibInfo,fnLoadLibrary = (PROCLOADLIBRARY) GetProcAddress(hinstKrnl, 
    (fUnicode ? "LoadLibraryW" : "LoadLibraryA")); 
    IniLiblnfo.fnFreeLibrary = (PROCFREELIBRARY) 
    GetProcAddress(hinstKrnl, "FreeLibrary"); 
    InjLibInfo.pbLibFile[0] = 0; //   
    -_try { 
    
    //    INJLIBINFO, 
    //     DLL 
    if (fUnicode) 
    wcscpy((LPWSTR) InjLibInfo.pbLibFile, (LPCWSTR) pbLibFile); 
    else 
    strcpy(CLPSTR) InjLibInfo.pbLibFile, (LPCSTR) pbLibFile): 
    
    //       , 
    //     ThreadFunc   INJLIBINFO 
    pdwCodeRemote = (PDWORD) AllocProcessMemory(hProcess, cbMemSize); 
    if (pdwCodeRemote == NULL) __leave; 
    //       
    //  ", , " 

    . . . 

    _____________________ 18.     639 


    . IS^S () 

    f0k = VirtualProtectEx(hProcess, pdwCodeRemote, 
    cbMemSize, PAGE_EXECUTE_REAOWRITE, &dw01dProtect); 
    if (!f0k) 
    leave; 
    //   ThreadFunc    
    f0k = WriteProcessMeniory(hProcess, pdwCodeRemote, 
    (LPVOID)(DWORD) ThreadFunc, cbCodeSize, &dwNumBytesXferred); 
    if (!f0k) 
    __leave; 
    //   INJLIBINFO     
    // (      32- ) 
    pInjLibInfoRemote = (PINJLIBINFO) 
    ((PBYTE.) pdwCodeRemote + ((CbCodeSize + 4) & ~3)); 
    //  InjLibInfo       
    f0k = WriteProcessMemory(hProcess, pInjLibInfoRemote, 
    &InjLibInfo, sizeof(InjLibInfo), &dwNumBytesXferred); 
    if (!f0k) 
    leave; 
    hThread = CreateRernoteThread(hProcess, NULL, 0, 
    (LPTHREAD_START_ROUTINE)(DWORD) pdwCodeRemote, 
    pInjLibInfoRemote. 0,' &dwThreadId); 
    if (hThread == NULL) 
    __leave; 
    WaitPorSingleObject(hThread, INFINITE); 
    } // try 
    __finally { 
    if (hThread != NULL) { 
    GetExitCodeThread(hThread. (PDWORD) &hinstDllRemote); 
    CloseHandle(hThread); 
    //      ThreadFunc 
    //     ,   
    //    INJLIBINFO 
    FreeProcessMeinory(hProcess, pdwCodeRemote); 
    } //finally 
    //  TRUE,   DLL   
    return(hihst011Remote != NULL); 
    } 
    HHIIII IIIllllllllll lllll/lllllllll lllllllllllll/I IIIIIIIIIIIIII IIIIIIIIIIH/1 

    . . . 

    640 ______________________________Windows   


    . 18-5 () 

    BOOL WINAPI InjectLibA (HANDLE hProcess, LPCSTR IpszLibFile) { 
    return(InjectLibWorA(hProcess, (LPBYTE) IpszLibFile, FALSE)); 
    /////////////////////////////////////////////////////////////////////////////// 
    BOOL WINAPI InjectLibW (HANDLE hProcess, LPCWSTR IpszLibFile) { 
    return(InJectLibWorA(hProcess, (LPBYTE) IpszLibFile, TRUE)); 
    //////////////////////////////////   ///////////////////////////////// 
    INJLIB.H 
    /,..,.,...*.**...*...*.*.*...*.,,.,...*,..*,.*.**.^**<*..* 
    : InjLib.H 
    : Copyright  1995-1997,   (Jeffrey Richter) 
    BOOL WINAPI InjectLibA (HANDLE hProcess, LPCSTR IpszLibFile); 
    BOOL WINAPI InjectLibW (HANDLE hProcess. LPCWSTR IpszLibFile); 
    ffifdef UNICODE 
    define InjectLib InjectLibW 
    #else 
    Bdefine InjectLib InjectLibA 
    sendif // 'UNICODE 
    //7///////////////////////////////   I  / I I I I I H I i I I I 
I I I I I I I I I I I I I I I I i 


      InjectUb 

      InjectLib,      . 
    ,    .    
2  InjectLib.     TInjLib (  
InjectLib)  DLL     .    
,   ,    .  , 
   DLL,  , ,  ,   
 DLL,   ,   InjectLib  . 

    - TInjLib 

     TInjLib (TINJLIB.EXE) (.   . 18-6) , 
   InjectLib.        
    TINJLIB  -,   . 
         
-     .    
    PVIEW.EXE  

    _____________________ 18.     641 

    PSTAT.EXE,   Visual C++,   Task Manager  
 Windows NT 4.  ,     
,    OpenProcess     : 

    hProcess = OpenProcess( 
    PROCESS_CREATE_THREAD :       //  CreateRemoteThread 
    PROCESS_QUERY_INFORMATION :   //  VirtualQueryEx 
    PROCESS_VM_OPERATION ;        //  VirtualProtectEx, VirtualAllocEx 
    
    //  VirtualFreeEx 
    PROCESS_VM_READ :             //  ReadProcessMemory 
    PROCESS_VM_WRITE,             //  WnteProcessMemory 
    FALSE, dwProcessId): 

     OpenProcess  NULL, TInjLib     
.     ,     
,        
. \32-    (, WinLogon, ClipSrv  
EventLog)  ,      ,  
  ,  . 
        OpenProcess  TInjLib  ,  
    DLL,   InjectLib.    
InjectLib   ,   ,   DLL  
 ;         . 
     ,   ,     , 
     ,    .  
,     TINJLIB.EXE,  GetCurrentProcessId. 
   InjectLib   DLL    
.      .  ,  
    ,     : 
  .        : 
   TInjLib,     .   
 .   ,  TInjLib   DLL   
, . .     .    
 . 

    TINJLIB.C 
    : TInjLib. 
    : Copyright  1995-1997,   (Jeffrey Richter) 
    include "..\CmnHdr.H"              /* .   */ 
    include <windows.h> 
    include <windowsx.h> 
    include <stdio.h> 
    include <tchar.h> 
    include "InjLib.H" 
    include "Resource.h" 
    Illlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllillll/l 

    . . . 

    . 18-6.   TInjLib 

    642 ___________________________.._Windows   


    . 18-6 () 

    BOOL Dlg_0nlnit0ialog (HWND hwnd, HWND hwndFocus, LPARAM IParam) { 
    //      
    chSETDLGICONS(hwnd, IOI_TINJLIB, IDI_TINJLIB); 
    returnfTPIJF): 
    ////// ///////////// ////////////// ////////////// //////////////// ///////////// 
    void Dlg_OnCommand (HWND hwnd. int id, HWND hwndCtI, UINT codeNotify) { 
    BOOL fTranslated; 
    DWORD dwProcessId; 
    HANDLE hProcess; 
    switch (id) { 
    case IDC_INJECT: 
    dwProcessId = GetDlgItemInt(hwnd, IDC_PROCESSID, &fTranslated, FALSE); 
    if (dwProcessId == 0) { 
    
    //    0,    
    //   ;    
    dwProcessId = GetCurrentProcessIdO; 
    ) 
    //     
    hProcess = OpenProcess( 
    PROCESS_CREATE_THREAD ;       //  CreateRemoteThread 
    PROCESS_QUERY_INFORMATION :   //  VirtualQueryEx 
    PROCESS_VM_OPERATION !        //  VirtualProtectEx 
    PROCESS_VM_READ ;             //  ReadProcessMemory 
    PROCESS_VM_WRITE,             //  WriteProcessMemory 
    FALSE, dwProcessId); 
    if (hProcess == NULL) { 
    chMB((GetLastError() == ERROR_ACCESS_DENIED) ? 
    __TEXT("Insufficient access to process") 
    : __TEXT("Invalid process Id")); 
    } else { 
    TCHAR szLibFile[MAX_PATH]: 
    GetModuleFileName(NULL, szLibFile, sizeof(szLibFile)); 
    _tcscpy(_tcsrchr(szLibFlle, 
    __TEXT('\\')) + 1, __TEXT("ImgWalk,DLL")); 
    chMB(InjectLlb(hProcess, szLibFile) ? 
    __TEXT("Remote DLL loaded") : 
    __TEXT("Remote DLL failed load")); 
    GloseHandle(hProcess); 
    } 
    break; 

    . . . 

    _____________________ 18.     643 


    . 18-6 () 

    case IDCANCEL: 
    EndDialogthwnd, id): 
    break; 
    v 
    ///////////////////////////////////////
    BOOL CALLBACK Dlg_Proc (HWND hwnd, UINT uMsg. WPARAM wParam, LPARAM 
IParam) { 
    switch (uMsg) { 
    chHANDLE_DLGMSG(hwnd, WM_INITDIALOG, DIg^OnInitDialog): 
    chHANDLE_DLGMSG(hwnd, WM_COMMAND, Dlg_OnCommand); 
    } 
    return(FALSE): 
    ////////////////////////////////////////////////
    int WINAPI _tWinMain (HINSTANGE hinstExe, 
    HINSTANCE hinstPrev, LPTSTR pszCmdLine, int nCmdShow) { 
    chWARNIFUNICODEUNDERWIN95(); 
    DialogBox(hinstExe, MAKEINTRESOURCE(IDD_TINJLIB), NULL, Dlg_Proc); 
    return(O); 
    /////////////////   ///////////////////////////////// 


       IMGWALK.DLL 

    IMGWALK.DLL (.   . 18-7)     
, ,      ,  
  DLL,   .      
      IMGWALK  -,  
 . , ,   Notepad,   TInjLib,  
   Notepad,  TInjLib  IMGWALK.DLL   
 Notepad.  , ImgWalk ,    ( 
 DLL)   Notepad,      (. 
   ). 
           ,   
ImgWalk,    .     
     . ,   , 
   ,     ,  , 
   ,      ,  
  .  InjectLib       
 DLL  ,     . 

    644 ______________________________Windows   


    01 B40000-H;\WINNT\system32\riotepad.exe 
    20000000-H:\MSDEV\BIN\SPY'HK40.DLL 
    76AAOOOO-H:\WINNT\Svstem32\INDICDLL.dll 
    779DOOOO-H:\WIMNT^system32\MSVCRT40.dll 
    779FOOOO-H:\WINNT\system32\MSVCRT.dll 
    77BFOOOO-H:\WINNT\systern32\COMCTL32.dll 
    77C40000-H:\WINNT\systern32',,SHELL32.dll 
    77DBOOOO-H:\WINNT\system32\comdlg32.dll 
    77DCOOOO-H:\WINNT\system32^DVAPI32.dll 
    77E20000-H:\WINNT\syslern32\RPCRT-1.dll 
    77E70000-H:\WINNT\syslem32\USER32.dll 
    77EDaOOO-H:\WIMMT^system32\GD132.dll 
    77FOOOOO-H:\WINNT\system32\l<ERNEL32.dll 
    77F60nOO-H:\WINNT\System32\ritdlLdll 
    780AOOOO-H;'\WINN'niSy8tem32\MSVCIRT.dll 
    T~o^j 

     ImgWalk       
  ,     VirtualQuery,  
  RY_BASIC_INFORMATION.     ImgWalk 
,       ,      
 ,   : 

    while (Vir'tualQuery(lp, &mbi, sizeof(mbi)) == sizeof(mbi)) { 
    if (mbi.State == MEM_FREE) 
    mbi.AllocationBase = mbi.BaseAddress; 
    if ((mbi.AllocationBase == hinstDll) ',', 
    (mbi.AllocationBase != mbi.BaseAddress) !! 
    (mbi.AllocationBase == NULL)) { 
    //      ,  
    //       : 
    // 1.     DLL. 
    // 2.      . 
    // 3,   NULL. 
    nLen = 0; 
    } else { 
    nLen = GetModuleFileName((HINSTANCE) mbi.AllocationBase, 
    szModName, ARRAY_SIZE(szModName)); 
    if (nLen > 0) { 
    _stprintf(_tcschr(szBuf, 0), __TEXT("\n%08X-%s"), 
    mbi.AllocationBase, szModName); 
    Ip += mbi.RegionSize; 
    J 

      ,         
  DLL.  ,   nLen,      
  DLL.      ,   
   .   nLen  0,  
,     

    ____________________ 18.     645 

     ,     szModName   (  
)  .    HINSTANCE   ( 
)       szBuf,        
.   , DLL      . 
    IMGWALK.C 
    : ImgWalk.C 
    : Copyright  1995-1997,   (Jeffrey Richter) 
    ^^^^^^^^,^^^^^,.^^,^^^,.,..,.^./ 
    ^include ",,\CmnHdr.H"              /* .   */ 
    ffinclude <windows.h> 
    einclude <stdio.h> 
    ftinclude <tchar,h> 
    ll/lllllll lll/lllllllll ll/llllllll/l/tll llllllHII/lllll/l lllllllllll lll/llllll 
    BOOL WINAPI DllMain (HINSTANCE hinstDll, DWORD fdwReason, 
    LPVOID IpvReserved) { 
    TCHAR szBuf[MAX_PATH * 30], szModNa(l)e[MAX_PATH]; 
    if (fdwReason == DLL_PROCESS_ATTACH) { 
    LPBYTE Ip = NULL; 
    MEMORY_BASIC_INFORMATION mbi; 
    int nLen; 
    szBuf[0] = 0; 
    szBuf[1] = 0; 
    while (VirtualQuery(lp, &mbi, sizeof(mbi)) == sizeof(mbi)) { 
    if (mbi.State == MEM_FREE) 
    mbi.AllocationBase = mbi.BaseAddress: 
    if ((mbi.AllocationBase == hinstDll) !! 
    (mbi.AllocationBase != mbi. BaseAddress) ',', 
    (mbi.AllocationBase == NULL)) { 
    //      ,  
    //       : 
    // 1.     DLL. 
    // 2.      . 
    // 3.   NULL, 
    nLen = 0; 
    } else { 
    nLen = GetModuleFileName( 
    (HINSTANCE) mbi.AllocationBase, 
    szModName, chDIMOF(szModName)); 

    . . . 

    . 18-7.  IMGWALK.DLL 

    646 ______________________________Windows   


    . 18-7 () 

    if (nLen > 0) { 
    _stpnntf(_tcschr(szBuf, 0), __TEXT( "\n%08X-%s"), 
    mbi.AllocationBase, szModName): 
    i 
    Ip += mbi.RegionSize; 
    } 
    chMB(&szBuf[1]); 
    } 
    return(TRUE); 
    i 
    //////////////////////////////////   ///////////////////////////////// 


     

               
 DLL,     . 

             

                                       Applnit_DLLs                   

      Windows 95?                                                   
      Windows NT?                                                   
      ?                                         
    ,                                              
     USER32.DLL? 
    ,                                             
     KERNEL32.DLL? 
        DLL                                  
      ? 
      DLL   .                                   
       USER32.DLL? 
                                                    ( 99%) 
    -? 
