[C#] 纯文本查看 复制代码
var Xls = new Spire.Xls.Workbook();
var ...[/quote]
[mw_shl_code=csharp,true]
using Spire.Xls;
using System;
using System.ComponentModel;
using System.Linq;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace SpireHook
{
internal class Program
{
internal class Natives
{
[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool FlushInstructionCache(IntPtr hProcess, IntPtr lpBaseAddress, UIntPtr dwSize);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr GetCurrentProcess();
[DllImport("kernel32.dll", SetLastError = true)]
public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
public enum PageProtection : uint
{
PAGE_NOACCESS = 0x01,
PAGE_READONLY = 0x02,
PAGE_READWRITE = 0x04,
PAGE_WRITECOPY = 0x08,
PAGE_EXECUTE = 0x10,
PAGE_EXECUTE_READ = 0x20,
PAGE_EXECUTE_READWRITE = 0x40,
PAGE_EXECUTE_WRITECOPY = 0x80,
PAGE_GUARD = 0x100,
PAGE_NOCACHE = 0x200,
PAGE_WRITECOMBINE = 0x400
}
}
private static void Main(string[] args)
{
uint VirtualProtect(IntPtr address, uint size, uint protectionFlags)
{
uint oldProtection;
if (!Natives.VirtualProtect(address, (UIntPtr)size, protectionFlags, out oldProtection))
{
throw new Win32Exception();
}
return oldProtection;
}
void FlushInstructionCache(IntPtr address, uint size)
{
if (!Natives.FlushInstructionCache(Natives.GetCurrentProcess(), address, (UIntPtr)size))
{
throw new Win32Exception();
}
}
var Xls = new Spire.Xls.Workbook();
Func<object, object, bool> replacemethod = (a0, a1) => true;
var replacement = replacemethod.GetMethodInfo();
foreach (var item in Xls.GetType().Assembly.DefinedTypes)
{
if (item.DeclaredFields.Count() == 4 && item.DeclaredMembers.Count() == 11 && item.DeclaredMethods.Count() == 5)
{
if (item.GetMethods(BindingFlags.Static | BindingFlags.NonPublic).Length == 5)
{
foreach (var item2 in item.GetMethods(BindingFlags.Static | BindingFlags.NonPublic))
{
if (item2.ReturnParameter.ParameterType.Name == "Boolean")
{
if (item2.GetParameters().Length == 2)
{
if (item2.GetParameters()[0].ParameterType.Name == "Object")
{
RuntimeHelpers.PrepareMethod(item2.MethodHandle);
RuntimeHelpers.PrepareMethod(replacement.MethodHandle);
IntPtr originalSite = item2.MethodHandle.GetFunctionPointer();
IntPtr replacementSite = replacement.MethodHandle.GetFunctionPointer();
var is64 = IntPtr.Size != sizeof(int);
uint offset = (is64 ? 13u : 6u);
byte[] originalOpcodes = new byte[offset];
unsafe
{
//segfault protection
uint oldProtecton = VirtualProtect(originalSite, (uint)originalOpcodes.Length, (uint)Natives.PageProtection.PAGE_EXECUTE_READWRITE);
//get unmanaged function pointer to address of original site
byte* originalSitePointer = (byte*)originalSite.ToPointer();
//copy the original opcodes
for (int k = 0; k < offset; k++)
{
originalOpcodes[k] = *(originalSitePointer + k);
}
if (is64)
{
//mov r11, replacementSite
*originalSitePointer = 0x49;
*(originalSitePointer + 1) = 0xBB;
*((ulong*)(originalSitePointer + 2)) = (ulong)replacementSite.ToInt64(); //sets 8 bytes
//jmp r11
*(originalSitePointer + 10) = 0x41;
*(originalSitePointer + 11) = 0xFF;
*(originalSitePointer + 12) = 0xE3;
}
else
{
//push replacementSite
*originalSitePointer = 0x68;
*((uint*)(originalSitePointer + 1)) = (uint)replacementSite.ToInt32(); //sets 4 bytes
//ret
*(originalSitePointer + 5) = 0xC3;
}
FlushInstructionCache(originalSite, (uint)originalOpcodes.Length);
VirtualProtect(originalSite, (uint)originalOpcodes.Length, oldProtecton);
}
break;
}
}
}
}
break;
}
}
}
Xls.LoadFromFile(@"ExceltoImage.xlsx", ExcelVersion.Version2010);
Worksheet sheet2 = Xls.Worksheets[0];
sheet2.SaveToImage("ExceltoImage.jpg");
}
}
}
[复制链接]
发表于 2022-9-7 15:26
发表于 2022-9-7 18:12
