HookHop von PostMessage geht nicht

[WorstNightmare]

Hallo,

ich versuche jetzt seit einer Stunde einen Hook von PostMessage zu umgehen.
Dazu teste ich erstmal am Editor:

Delphi-Quellcode:

procedure TForm1.FormCreate(Sender: TObject);
begin
  u32 := LoadLibrary(user32);
  PostMessageReal := DWORD(GetProcAddress(u32, 'PostMessageA')) + 5;
end;

function _PostMessage(hWnd: HWND; uMsg: UINT; wParam: WPARAM; lParam: LPARAM): BOOL;
begin
  asm
    push    ebp
    mov     ebp, esp
    jmp     dword ptr ds:[PostMessageReal]
  end;

  Result := True;
end;

procedure TForm1.ToolButton1Click(Sender: TObject);
var
  wnd: hwnd;
begin
  wnd := FindWindowEx(hauptwnd, 0, 'Edit', '');
  _PostMessage(Wnd, WM_CHAR, Ord('A'), 0);
end;

Es kommt immer: Externe Exception C000001E.
In C++ scheint dieser Code zu laufen, muss ich in Delphi dabei was besonderes beachten?

Code:

DWORD _PMA = (DWORD)GetProcAddress(LoadLibrary("user32.dll"), "PostMessageA") + 5; 

__declspec(naked) BOOL WINAPI _PostMessageA(HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
    __asm
    {
        push   ebp
        mov    ebp, esp
        jmp    dword ptr ds:[_PMA]
   }
   return 0;
}

[TurboMartin]

Versuche es doch mal mit WM_KEYDOWN und WM_KEYUP zu senden

Delphi-Quellcode:

procedure TForm1.ToolButton1Click(Sender: TObject);
var
  wnd: hwnd;
begin
  wnd := FindWindowEx(hauptwnd, 0, 'Edit', '');
  _PostMessage(Wnd, WM_KEYDOWN, Ord('A'), 0);
  _PostMessage(Wnd, WM_KEYUP, Ord('A'), 0);
end;

oder so ähnlich, arbeite eben meist nur noch mit C#

[WorstNightmare]

Aber der Hop schränkt doch die Funktionsweise nicht ein. Wenn ich das _ bei mir weglasse, also das "normale" PostMessage aufgerufen wird geht es einwandfrei, 'A' erscheint im Editor. WM_CHAR sollte also gehen.

[Remko]

PostMessageA has the stdcall calling convention but your function _PostMessage does not!
You should declare _PostMessage as stdcall and remove the begin and end (then delphi doesn't create a stackframe):

Delphi-Quellcode:

function _PostMessage(hWnd: HWND; uMsg: UINT; wParam: WPARAM; lParam: LPARAM): BOOL; stdcall;
  asm
    jmp     dword ptr ds:[PostMessageReal];
    mov     eax, 1;
  end;
end;

procedure TForm1.ToolButton1Click(Sender: TObject);
var
  wnd: hwnd;
begin
  wnd := FindWindowEx(hauptwnd, 0, 'Edit', '');
  _PostMessage(Wnd, WM_CHAR, Ord('A'), 0);
end;

It's not clear to me though why you are incrementing the function pointer by 5 (or why the c code does that), also are you supposed to increment by 5 bytes or by 5 dword's ?

[WorstNightmare]

Delphi-Quellcode:

procedure TForm1.FormCreate(Sender: TObject);
begin
  u32 := LoadLibrary(user32);
  PostMessageReal := DWORD(GetProcAddress(u32, 'PostMessageA')) + 5;
end;

function _PostMessage(hWnd: HWND; uMsg: UINT; wParam: WPARAM; lParam: LPARAM): BOOL; stdcall;
asm
  jmp  dword ptr ds:[PostMessageReal]
  mov  eax, 0
end;

procedure TForm1.ToolButton1Click(Sender: TObject);
var
  wnd: hwnd;
begin
  wnd := FindWindowEx(hauptwnd, 0, 'Edit', '');
  _PostMessage(Wnd, WM_CHAR, Ord('A'), 0);
end;

Thanks, this works now.
I add 5 bytes, because I want to avoid calling a hook that might have been installed.
E.g. the first 5 bytes of PostMessageA could look like this:

Code:

mov edi, edi
push ebp
mov ebp, esp

These can be overwritten with a jmp which calls the redirection, which I want to avoid.

But I don't get why I can leave away the other assembler commands in Delphi.

[Remko]

The "other" asm just rewinds the stackframe that delphi puts up for you (begin..end), because we left that out we don't need to rewind the stackframe.