Gibt es eine Möglichkeit das Erscheinen einer Messagebox abzufragen??

mfg
steve888

in dem beispiel wird sogar zufällig die messagebox-func gehookt

Was ich letztlendlich erhielt war dieser Fehlercode:

ker-Vorgang läuft...
LIBCD.lib(wincrt0.obj) : error LNK2001: Nichtaufgeloestes externes Symbol _WinMain@16
Debug/test4.exe : fatal error LNK1120: 1 unaufgeloeste externe Verweise

Ich weis, man könnte sich den Sourcecode downloden wenn man sich registriert.
Es kann aber ja nicht so schwer sein, dieses Beispiel selbst zu Erstellen. Hätte wer Tipps für mich??

schau dir mal an was WinMain() ist.

#include <windows.h>

#define SIZE 6

typedef int (WINAPI *pMessageBoxW)(HWND, LPCWSTR, LPCWSTR, UINT);
int WINAPI MyMessageBoxW(HWND, LPCWSTR, LPCWSTR, UINT);

void BeginRedirect(LPVOID);

pMessageBoxW pOrigMBAddress = NULL;
BYTE oldBytes[SIZE] = {0};
BYTE JMP[SIZE] = {0};
DWORD oldProtect, myProtect = PAGE_EXECUTE_READWRITE;

INT APIENTRY DllMain(HMODULE hDLL, DWORD Reason, LPVOID Reserved)
{
    switch(Reason)
    {
    case DLL_PROCESS_ATTACH:
        pOrigMBAddress = (pMessageBoxW)
            GetProcAddress(GetModuleHandle("user32.dll"), 
                           "MessageBoxW");
        if(pOrigMBAddress != NULL)
            BeginRedirect(MyMessageBoxW);    
        break;
    case DLL_PROCESS_DETACH:
        memcpy(pOrigMBAddress, oldBytes, SIZE);
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
        break;
    }
    return TRUE;
}

void BeginRedirect(LPVOID newFunction)
{
    BYTE tempJMP[SIZE] = {0xE9, 0x90, 0x90, 0x90, 0x90, 0xC3};
    memcpy(JMP, tempJMP, SIZE);
    DWORD JMPSize = ((DWORD)newFunction - (DWORD)pOrigMBAddress - 5);
    VirtualProtect((LPVOID)pOrigMBAddress, SIZE, 
                    PAGE_EXECUTE_READWRITE, &oldProtect);
    memcpy(oldBytes, pOrigMBAddress, SIZE);
    memcpy(&JMP[1], &JMPSize, 4);
    memcpy(pOrigMBAddress, JMP, SIZE);
    VirtualProtect((LPVOID)pOrigMBAddress, SIZE, oldProtect, NULL);
}

int  WINAPI MyMessageBoxW(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uiType)
{
    VirtualProtect((LPVOID)pOrigMBAddress, SIZE, myProtect, NULL);
    memcpy(pOrigMBAddress, oldBytes, SIZE);
    int retValue = MessageBoxW(hWnd, lpText, lpCaption, uiType);
    memcpy(pOrigMBAddress, JMP, SIZE);
    VirtualProtect((LPVOID)pOrigMBAddress, SIZE, oldProtect, NULL);
    return retValue;
}

von http://www.codeproject.com/KB/DLL/funapihook.aspx
eine DLL erstellt.
Nur wie kann wie sie anwenden ??? - Brauch ich dazu ein eigenes C++ Programm dazu oder??

4. DLL Injection

I’ve done a lot of talking about DLL injection in this article. The DLLs with the API hooks in them have to be injected into the address space of the process in order for them to work. DLL injection involves somehow loading a DLL that is not normally loaded by the process. There are multitudes of ways to do this. A very common one is to use the SetWindowsHookEx(…) with a dummy hook procedure. Another common one is to use the CreateRemoteThread(…) API. It’s possible to even hardcode a CodeCave stub to load a DLL (I did this in the Solitaire article). The approach that I will be taking and explaining in this article will be the CreateRemoteThread one. It is extremely easy, and relatively efficient. Before starting though, it is important to actually find the process to inject into.