[原创]修复spy4win无法取ListView内容的BUG
逆向发现之所以无法取得ListView的子项内容，是因为没有初始化ListView窗口的ListHeader句柄(此局部变量我们标记为hWndListHeader),就在对它调用SendMessage(hWndListHeader,HDM_GETITEMCOUNT,0,0)了，所以返回值始终为0，所以这个对话框始终是空的，
对其进行修复，也就是获取到hWndListHeader句柄，再执行原逻辑。
好了，成功了，现在能获取到子项内容了。
附修复代码：
// MyWork.cpp
#include "stdafx.h"
PVOID Ori_Call_SendMessageA_HDM_GETITEMCOUN_NoGetListHeaderHWND;
__declspec(naked) void Fix_Call_SendMessageA_HDM_GETITEMCOUN_NoGetListHeaderHWND()
{
/*
hListViewWnd = ebx
hWndListHeader = dword ptr -3Ch
................................................................
.text:0040857D push 0 ; lParam
.text:0040857F push 0 ; wParam
.text:00408581 push 1200h ; Msg
.text:00408586 mov eax, [ebp+hWndListHeader]
.text:00408589 push eax ; hWnd
.text:0040858A call j_SendMessageA
*/
__asm
{
push 0
push 0
push LVM_GETHEADER
push ebx //hListViewWnd
mov eax,[SendMessageA]
call eax
mov [ebp-3ch],eax //hWndListHeader
jmp Ori_Call_SendMessageA_HDM_GETITEMCOUN_NoGetListHeaderHWND;
}
}
void BeginMyWork()
{
PVOID pThatFunction=(0x0040857D-0x00400000)+(PBYTE)GetModuleHandle(NULL);
HookFunction(pThatFunction,Fix_Call_SendMessageA_HDM_GETITEMCOUN_NoGetListHeaderHWND,&Ori_Call_SendMessageA_HDM_GETITEMCOUN_NoGetListHeaderHWND);
}
void EndMyWork()
{
PVOID pThatFunction=(0x0040857D-0x00400000)+(PBYTE)GetModuleHandle(NULL);
UnhookFunction(pThatFunction,&Ori_Call_SendMessageA_HDM_GETITEMCOUN_NoGetListHeaderHWND);
}
// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "stdafx.h"
#pragma comment(linker,"/EXPORT:DllMain=_DllMain@12")
void BeginMyWork();
void EndMyWork();
EXTERN_C BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
{
//MessageBox(NULL,_T("加载成功"),_T("XXX.DLL"),MB_OK);
BeginMyWork();
}
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
{
EndMyWork();
}
break;
}
return TRUE;
}
编译为XXX.DLL,并对脱壳后Spy4Win.exe，用Lord PE的PE编辑器添加对XXX.DLL的依赖。Spy4Win.exe的脱壳，可以直接用Peid搞定。
HookFunction，及UnhookFunction是inline hook函数，可以在mhook等开源hook库中找到类似函数，本人恕不提供。
完美收官，YEAH。
