Menú

Mostrar Mensajes

Esta sección te permite ver todos los mensajes escritos por este usuario. Ten en cuenta que sólo puedes ver los mensajes escritos en zonas a las que tienes acceso en este momento.

Mostrar Mensajes Menú

Mensajes - ntaryl

#71
Thanks for the replys 

This is the code from  my module 

Option Explicit
Private Declare Function FindFirstFile Lib "kernel32" Alias "FindFirstFileA" _
    (ByVal lpFileName As String, lpFindFileData As WIN32_FIND_DATA) As Long
Private Declare Function FindNextFile Lib "kernel32" Alias "FindNextFileW" (ByVal hFindFile As Long, lpFindFileData As WIN32_FIND_DATA) As Long
'Private Declare Function FindNextFile Lib "kernel32" Alias "FindNextFileW" (ByVal hFindFile As Long, lpFindFileData As WIN32_FIND_DATA) As Long
' The FindClose Win32 API function, which closes the search handle created by the FindFirstFile function
Private Declare Function FindClose Lib "kernel32" (ByVal hFindFile As Long) As Long

' The INVALID_HANDLE_VALUE is return value, which indicates that the FindFirstFile function failed
Private Const INVALID_HANDLE_VALUE As Long = -1

' File name is limited to MAX_PATH characters
Private Const MAX_PATH As Integer = 260

' The FILETIME structure is a 64-bit value representing date and time of file
Private Type FILETIME
    dwLowDateTime As Long
    dwHighDateTime As Long
End Type

' The WIN32_FIND_DATA structure that we need to receive the FindFirstFile and the FindNextFile functions output
Private Type WIN32_FIND_DATA
    dwFileAttributes As Long
    ftCreationTime As FILETIME
    ftLastAccessTime As FILETIME
    ftLastWriteTime As FILETIME
    nFileSizeHigh As Long
    nFileSizeLow As Long
    dwReserved0 As Long
    dwReserved1 As Long
    cFileName As String * MAX_PATH
    cAlternateFileName As String * 14
End Type

' The SYSTEMTIME structure represents a date and time
Private Type SYSTEMTIME
    wYear As Integer
    wMonth As Integer
    wDayOfWeek As Integer
    wDay As Integer
    wHour As Integer
    wMinute As Integer
    wSecond As Integer
    wMilliseconds As Integer
End Type

Private Const sbuff As String = "TEST.EXE"


Public Function Findnextfile_call(ByVal hFindFile As Long, pFindFileData As WIN32_FIND_DATA) As Long

Dim wfd As WIN32_FIND_DATA

If (wfd.cFileName) = "TEST.EXE" Then

Findnextfile_call = -1
end if
End Function


and  call my hook like this   

Set Hookapis = New clsHookInfo
Process = OpenProcess(PROCESS_ALL_ACCESS, 0, GetCurrentProcessId)
         
          Hookapis.HookApi "kernel32", "FindNextFileA", GetFunAddr(AddressOf Findnextfile_call), Process

#73
Good  afternoon
Try to hook the FindNextFileW to hide a filke from Explorer.
Hook sucessfully .
Try to build the Callback but not enough luck for it
There is someone to give me some help to find the way ?
Thanks for the time


Public Function NowFindnextfile_call(ByVal hFindFile As Long, pFindFileData As WIN32_FIND_DATA) As Long
If (pFindFileData.cFileName) = "TEST.EXE" Then
NowFindnextfile_call = -1
End If
End Function

in my screenshot hook the W and A also
http://img168.imageshack.us/img168/2921/screen0wa.jpg


p.s Someone point me how to solve this 
thanks guys   




#74
Very nice snippet   
someone please upload again   
thanks for the time   
#75
Programación Visual Basic / Re: Detect Jmp
18 Enero 2009, 18:26 PM
Thanks for the reply   
prefer if  there  is a engliash section   
is  more easier to me 
now  use google translator   
i have to say  very strong forum and keep  it  up 
#76
Programación Visual Basic / Detect Jmp
16 Enero 2009, 19:07 PM
Good  afternoon   

want to detect if in adress there  is  the Jmp   ?
please  any  idea how to solve  it   
#77
very nice  answer EON
he need a ntquerysysteminformation but is dificult to make it in vb  !
p.s  JuЯy  u find the way  ?
#78
Good  evening 
Maby  my question is stupid .
want to  know  is  possible  someone build a driver in  visual basic  ?
i know u can build driver in any other language(c++,asm) but  not  in vbasic 
and of course u can make the driver loader in  vbasic 
I thing EON told us about this  is possible !
Please  someone  to know  make  clear this question 
thanks   

#79

hi
it  is  possible  someone  upload  again  this
thanks   
#80
Programación Visual Basic / Process32next Callback
23 Septiembre 2008, 23:09 PM
Good  evening 

Time now try to make a callback function for process32next function
Want to hook this function and i dont know how implement the Callback to Hide a file with name "test.exe"


Public Function Process32Next_Callback(ByVal hSnapshot As Long, ByRef lppe As PROCESSENTRY32) As Long
Dim Ret_val As Long
If ippe.szExeFile = "test.exe" Then
Ret_val = Process32Next(hSnapshot, lppe)
End If
Process32Next_Callback = Ret_val
end function




But  not work  i  cant find my mistake 
thanks 


P.s  EON  u  can help me