Speicher überwachen

[brechi]

Delphi-Quellcode:

var
  RtlDispatchExceptionNext: function(excRec: PExceptionRecord; excCtxt:
    PContext): integer; stdcall = nil;

function RtlDispatchExceptionCallback(excRec: PExceptionRecord; excCtxt:
  PContext): integer; stdcall;
begin
  result := RtlDispatchExceptionNext(excRec, excCtxt);
  // Exception Handling
end;

procedure InstallExcDispatchHook;
var
  c1, c2: dword;
begin
  c1 := dword(GetProcAddress(GetModuleHandle('ntdll.dll'),
    'KiUserExceptionDispatcher'));
  if Byte(pointer(c1)^) = $FC then
    inc(c1);
  if (dword(pointer(c1)^) = $04244C8B) and // mov  ecx, [esp+4] ; PContext
  (dword(pointer(c1 + 4)^) and $00FFFFFF = $241C8B) and
    // mov  ebx, [esp+0] ; PExceptionRecord
  (byte(pointer(c1 + 7)^) = $51) and // push ecx
  (byte(pointer(c1 + 8)^) = $53) and // push ebx
  (byte(pointer(c1 + 9)^) = $E8) and // call RtlDispatchException
  VirtualProtect(pointer(c1 + 10), 4, PAGE_EXECUTE_READWRITE, c2) then
  begin
    RtlDispatchExceptionNext := pointer(c1 + 14 + dword(pointer(c1 + 10)^));
    dword(pointer(c1 + 10)^) := dword(@RtlDispatchExceptionCallback) - c1 - 14;
    VirtualProtect(pointer(c1 + 10), 4, c2, c2);
  end;
end;

Sollte ab Windows2k funktionieren.

ReadProcessMemory verursacht übrigens keine Exception. Und mit VirtualProtectEx wirst du nichts mitbekommen...