All pastes #244776 Raw Edit

Something

public text v1 · immutable
#244776 ·published 2006-11-10 04:25 UTC
rendered paste body
; goto Build
.386
.model flat, stdcall
option casemap :none

include \masm32\include\windows.inc
include \masm32\include\kernel32.inc

includelib \masm32\lib\kernel32.lib

.data
_Kernel32		db "kernel32.dll", 0
_GetDriveTypeW	db "GetDriveTypeW", 0
FileName		db "cruddme3.exe",0
Patch			db 0B8h, 05h, 00h, 00h ,00h, 0c2h, 04h, 00h    ; mov eax, 5  |  ret 4

Startinfo		STARTUPINFO <>
Procinfo		PROCESS_INFORMATION <>

.code
start:
invoke LoadLibrary, ADDR _Kernel32
invoke GetProcAddress, eax, ADDR _GetDriveTypeW
mov dword ptr [_GetDriveTypeW], eax
invoke CreateProcess, ADDR FileName, 0, 0, 0, 0, 0, 0, 0, ADDR Startinfo, ADDR Procinfo
invoke Sleep, 50d
invoke WriteProcessMemory,Procinfo.hProcess,dword ptr _GetDriveTypeW,ADDR Patch,8,0
invoke CloseHandle, Procinfo.hThread
invoke ExitProcess,0
end start
:Build
\masm32\bin\ml /coff /c /nologo MakeAPIHook.bat
\masm32\bin\link /out:"API Hook.exe" /SUBSYSTEM:WINDOWS /nologo MakeAPIHook.obj
del *.exp
del *.lib
del *.obj