typedef struct CODE { int Ptr[4 * 4]; }*LPCODE; /*__declspec(naked) */static LPVOID WINAPI Alloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes) { return AppBase::Allocate(dwBytes); } /*__declspec(naked) */static LPVOID WINAPI ReAlloc(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, SIZE_T dwBytes) { return AppBase::ReAlloc(lpMem, dwBytes); } /*__declspec(naked) */static BOOL WINAPI Collect(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) { AppBase::Collect(lpMem); return TRUE; } /*__declspec(naked) */static BOOL WINAPI Validate(HANDLE hHeap,DWORD dwFlags,LPVOID lpMem) { return AppBase::Validate(lpMem)? TRUE : FALSE; } /*__declspec(naked) */static SIZE_T WINAPI SizeOf(HANDLE hHeap,DWORD dwFlags, LPVOID lpMem) { return AppBase::GetSize(lpMem); } void hook() { LPCODE pCode = (LPCODE)(HeapAlloc), pCodeConst; LONG nCode = 0; __asm { mov eax, offset X86_CODE_BEGIN mov pCodeConst, eax mov nCode, offset X86_CODE_END sub nCode, eax } System::IO::MemoryAllocator::Protect(AppBase::GetCurrentProcess(), pCode, nCode, RLIB_PAGE_EXECUTE_READWRITE); System::IO::Memory::memcpy(pCode, pCodeConst, nCode); goto X86_CODE_END; X86_CODE_BEGIN: __asm { push Alloc ret } X86_CODE_END: pCode = (LPCODE)(HeapFree); __asm { mov eax, offset X86_CODE_BEGIN_X mov pCodeConst, eax mov nCode, offset X86_CODE_END_X sub nCode, eax } System::IO::MemoryAllocator::Protect(AppBase::GetCurrentProcess(), pCode, nCode, RLIB_PAGE_EXECUTE_READWRITE); System::IO::Memory::memcpy(pCode, pCodeConst, nCode); goto X86_CODE_END_X; X86_CODE_BEGIN_X: __asm { push Collect ret } X86_CODE_END_X: pCode = (LPCODE)(HeapReAlloc); __asm { mov eax, offset X86_CODE_BEGIN_Z mov pCodeConst, eax mov nCode, offset X86_CODE_END_Z sub nCode, eax } System::IO::MemoryAllocator::Protect(AppBase::GetCurrentProcess(), pCode, nCode, RLIB_PAGE_EXECUTE_READWRITE); System::IO::Memory::memcpy(pCode, pCodeConst, nCode); goto X86_CODE_END_Z; X86_CODE_BEGIN_Z: __asm { push ReAlloc ret } X86_CODE_END_Z: pCode = (LPCODE)(HeapValidate); __asm { mov eax, offset X86_CODE_BEGIN_A mov pCodeConst, eax mov nCode, offset X86_CODE_END_A sub nCode, eax } System::IO::MemoryAllocator::Protect(AppBase::GetCurrentProcess(), pCode, nCode, RLIB_PAGE_EXECUTE_READWRITE); System::IO::Memory::memcpy(pCode, pCodeConst, nCode); goto X86_CODE_END_A; X86_CODE_BEGIN_A: __asm { push Validate ret } X86_CODE_END_A: pCode = (LPCODE)(HeapSize); __asm { mov eax, offset X86_CODE_BEGIN_V mov pCodeConst, eax mov nCode, offset X86_CODE_END_V sub nCode, eax } System::IO::MemoryAllocator::Protect(AppBase::GetCurrentProcess(), pCode, nCode, RLIB_PAGE_EXECUTE_READWRITE); System::IO::Memory::memcpy(pCode, pCodeConst, nCode); goto X86_CODE_END_V; X86_CODE_BEGIN_V: __asm { push SizeOf ret } X86_CODE_END_V: return; }