.386 .MODEL flat,stdcall OPTION CASEMAP:NONE Include windows.inc include advapi32.inc includelib advapi32.lib .DATA szTest db 'Hello',0 szHKLM db 'H7Default\HKEY_LOCAL_MACHINE',0 szHKCU db 'H7Default\HKEY_CURRENT_USER',0 Ts dd 0 LM dd 0 CU dd 0 .DATA? .code DllEntry proc hInstance:HINSTANCE, reason:DWORD, reserved1:DWORD .if reason==DLL_PROCESS_ATTACH call Hook .elseif reason==DLL_PROCESS_DETACH call UnHook .elseif reason==DLL_THREAD_ATTACH .else ; DLL_THREAD_DETACH .endif mov eax,TRUE ret DllEntry Endp Hook proc invoke RegCreateKeyEx,HKEY_CURRENT_USER,addr szHKCU,0,NULL,REG_OPTION_NON_VOLATILE,KEY_ALL_ACCESS,NULL,addr CU,NULL invoke RegCreateKeyEx,HKEY_CURRENT_USER,addr szHKLM,0,NULL,REG_OPTION_NON_VOLATILE,KEY_ALL_ACCESS,NULL,addr LM,NULL invoke RegOverridePredefKey,HKEY_CURRENT_USER,addr CU invoke RegOverridePredefKey,HKEY_LOCAL_MACHINE,addr LM invoke RegCreateKey,HKEY_CURRENT_USER,addr szTest,addr Ts ret Hook endp UnHook proc invoke RegOverridePredefKey,HKEY_CURRENT_USER,NULL invoke RegOverridePredefKey,HKEY_LOCAL_MACHINE,NULL invoke RegCloseKey,addr CU invoke RegCloseKey,addr LM ret UnHook endp End DllEntry
تم تعديل هذه المشاركة بواسطة H7SE في 13 فبراير 2007 في 07:55