kumatti1’s gists

kumatti1 / Module2.bas

Last active January 8, 2021 04:07

RtlCaptureStackBackTrace

	Option Explicit

	Private Declare PtrSafe _
	Function SymInitialize Lib "imagehlp.dll" ( _
	ByVal FramesToSkip As LongPtr, _
	ByVal UserSearchPath As String, _
	ByVal fInvadeProcess As Long _
	) As Long

	Private Declare PtrSafe _

kumatti1 / Module1.bas

Last active February 20, 2024 15:47

GetProcAddressHook2

	Option Explicit

	Private Declare PtrSafe Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As LongPtr
	Private Declare Function IsBadWritePtr Lib "kernel32" _
	(ByVal lp As Long, ByVal ucb As Long) As Long
	Private Declare Function VirtualProtect Lib "kernel32" _
	(ByVal lpAddress As Long, ByVal dwSize As Long, _
	ByVal flNewProtect As Long, lpflOldProtect As Long) As Long
	Private Declare Function VirtualAlloc Lib "kernel32" _
	(ByVal lpAddress As Long, ByVal dwSize As Long, _

kumatti1 / Module1.bas

Last active January 8, 2021 04:10

Declareフック

	Option Explicit

	Private Declare PtrSafe Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As LongPtr
	Private Declare Function IsBadWritePtr Lib "kernel32" _
	(ByVal lp As Long, ByVal ucb As Long) As Long
	Private Declare Function VirtualProtect Lib "kernel32" _
	(ByVal lpAddress As Long, ByVal dwSize As Long, _
	ByVal flNewProtect As Long, lpflOldProtect As Long) As Long
	Private Declare Function VirtualAlloc Lib "kernel32" _
	(ByVal lpAddress As Long, ByVal dwSize As Long, _

kumatti1 / Module2.bas

Last active August 29, 2015 14:22

GetProcAddressHook

	Option Explicit

	Private Declare PtrSafe Function LoadLibrary Lib "kernel32" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As LongPtr
	Private Declare Function IsBadWritePtr Lib "kernel32" _
	(ByVal lp As Long, ByVal ucb As Long) As Long
	Private Declare Function VirtualProtect Lib "kernel32" _
	(ByVal lpAddress As Long, ByVal dwSize As Long, _
	ByVal flNewProtect As Long, lpflOldProtect As Long) As Long
	Private Declare Function VirtualAlloc Lib "kernel32" _
	(ByVal lpAddress As Long, ByVal dwSize As Long, _

kumatti1 / Module1.bas

Created June 1, 2015 22:28

DispInvokeHook

	Option Explicit

	Private Declare Function IsBadWritePtr Lib "kernel32" _
	(ByVal lp As Long, ByVal ucb As Long) As Long
	Private Declare Function VirtualProtect Lib "kernel32" _
	(ByVal lpAddress As Long, ByVal dwSize As Long, _
	ByVal flNewProtect As Long, lpflOldProtect As Long) As Long
	Private Declare Function VirtualAlloc Lib "kernel32" _
	(ByVal lpAddress As Long, ByVal dwSize As Long, _
	ByVal flAllocationType As Long, _

kumatti1 / Module2.bas

Last active January 8, 2021 04:11

Midステートメントフック

	Option Explicit

	Private Declare Function IsBadWritePtr Lib "kernel32" _
	(ByVal lp As Long, ByVal ucb As Long) As Long
	Private Declare Function VirtualProtect Lib "kernel32" _
	(ByVal lpAddress As Long, ByVal dwSize As Long, _
	ByVal flNewProtect As Long, lpflOldProtect As Long) As Long
	Private Declare Function VirtualAlloc Lib "kernel32" _
	(ByVal lpAddress As Long, ByVal dwSize As Long, _
	ByVal flAllocationType As Long, _

kumatti1 / Module1.bas

Last active August 29, 2015 14:22

文字列連結フック

	Option Explicit

	Private Declare Function IsBadWritePtr Lib "kernel32" _
	(ByVal lp As Long, ByVal ucb As Long) As Long
	Private Declare Function VirtualProtect Lib "kernel32" _
	(ByVal lpAddress As Long, ByVal dwSize As Long, _
	ByVal flNewProtect As Long, lpflOldProtect As Long) As Long
	Private Declare Function VirtualAlloc Lib "kernel32" _
	(ByVal lpAddress As Long, ByVal dwSize As Long, _
	ByVal flAllocationType As Long, _

kumatti1 / Module5.bas

Last active August 29, 2015 14:21

&演算子を直で呼び出す

	Option Explicit

	Private Declare PtrSafe Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal length As LongPtr)
	Private Declare PtrSafe Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As LongPtr
	Private Declare PtrSafe Function GetProcAddress Lib "kernel32" (ByVal hModule As LongPtr, ByVal lpProcName As String) As LongPtr
	Private Declare PtrSafe _
	Function DispCallFunc Lib "OleAut32.dll" ( _
	ByVal pvInstance As LongPtr, _
	ByVal oVft As LongPtr, _
	ByVal cc_ As Long, _

kumatti1 / Module1.bas

Created May 23, 2015 22:42

Nameステートメントを直で呼び出す

	Option Explicit

	Private Declare PtrSafe Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As LongPtr
	Private Declare PtrSafe Function GetProcAddress Lib "kernel32" (ByVal hModule As LongPtr, ByVal lpProcName As String) As LongPtr
	Private Declare PtrSafe _
	Function DispCallFunc Lib "OleAut32.dll" ( _
	ByVal pvInstance As LongPtr, _
	ByVal oVft As LongPtr, _
	ByVal cc_ As Long, _
	ByVal vtReturn As Integer, _

kumatti1 / Module2.bas

Last active November 3, 2018 09:47

内部関数呼び出し

	Option Explicit

	Private Declare PtrSafe Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As LongPtr
	Private Declare PtrSafe Function GetProcAddress Lib "kernel32" (ByVal hModule As LongPtr, ByVal lpProcName As String) As LongPtr
	Private Declare PtrSafe _
	Function DispCallFunc Lib "OleAut32.dll" ( _
	ByVal pvInstance As LongPtr, _
	ByVal oVft As LongPtr, _
	ByVal cc_ As Long, _
	ByVal vtReturn As Integer, _