.net wpf程序 移花接木

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

using HookDetour;

using System;

using System.Collections.Generic;

using System.Linq;

using System.Reflection;

using System.Runtime.CompilerServices;

using System.Threading.Tasks;

using System.Windows.Forms;

namespace Load

{

    //这里是一个开源的hook库 根据名字自己google

    class hookClass : IMethodMonitor

    {

        [MethodImpl(MethodImplOptions.NoInlining)]

        [Monitor("System.Windows", "Application")] //目标方法的名称空间，类名

        public static void LoadComponent(Uri resourceLocator,bool b)

        {

            Console.WriteLine(resourceLocator);

            //mainwindow.baml

            var uri = new System.Uri(@"pack://application:,,,/MainApp;component/MainWindow.xaml");

            old_LoadComponent(uri, b);

        }

        [MethodImpl(MethodImplOptions.NoInlining)]

        [Original] //原函数标记

        public static void old_LoadComponent(Uri resourceLocator, bool b)

        {

            Console.WriteLine("null");

        }

    }

    static class Program

    {

        static MainApp.App pMainApp;

        private static void AppRun(object sender, object args)

        {

            //在这里开始干坏事

            Console.WriteLine("程序已经启动");

        }

        [STAThread]

        static void Main()

        {

            //建立目标程序导出的类 储存起来，方便找对应方法和变量

            pMainApp = new MainApp.App();

            //需要程序托管之类的操作需要初始化以后才能干，这里监听 Startup

            pMainApp.Startup += new System.Windows.StartupEventHandler(AppRun);

            //部分.net 程序查找不到自身目录资源，需要HOOK添加空间名

            //这个HOOK 不一定需要，有些程序加壳以后会自行修复这个问题，

            //hook LoadComponent 这个函数

            hookClass hk = new hookClass();

            var hookfun = hk.GetType().GetMethod("LoadComponent");

            var hookori = hk.GetType().GetMethod("old_LoadComponent");

            //通过 MainApp.App 得到父类 ,根据父类查找 LoadComponent函数

            MethodInfo LoadComponentFunction = pMainApp.GetType().BaseType.GetMethod("LoadComponent", BindingFlags.NonPublic | BindingFlags.Public | BindingFlags.Instance | BindingFlags.Static, System.Type.DefaultBinder, new Type[] { typeof(Uri),typeof(bool) },null);

            IDetour engine = DetourFactory.CreateDetourEngine();

            engine.Patch(LoadComponentFunction, hookfun, hookori);

            pMainApp.InitializeComponent();

            pMainApp.Run();

        }

    }

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

//这里节省资源，我就把Assembly储存起来了

public static Assembly GetAssembly()

{

    if (m_MainAppAssembly == null)

    {

        foreach (Assembly ay in AppDomain.CurrentDomain.GetAssemblies())

        {

            if (ay.FullName.IndexOf("AppMain") > -1)

            {

                m_CatchemAssembly = ay;

                break;

            }

        }

    }

    return m_MainAppAssembly ;

}