VB6 는 Ring 3 에서 Ring 0 층 함 수 를 직접 호출 하고 모든 R3 에서 API Hook 을 반대 합 니 다.

게시판 게시 물 받 기:http://topic.csdn.net/u/20120518/18/9a00ec5c-b3d1-4a1f-9bc1-ba1a47b52463.html
예 는 아래 와 같다.나 는 단지 여러분 에 게 방법 을 주 었 을 뿐 입 니 다. 이 방법 은 틀림없이 매우 번 거 로 울 것 입 니 다. 필요 한 사람 이 사용 할 수 있 습 니 다.
모듈 1 추가
Form 1, Command 1 추가
모듈 2 추가

Private asm_CallCode() As Byte, KiFastSystemCall&, KiIntSystemCall&
Private Declare Function CallWindowProcW& Lib "user32" (ByVal lpPrevWndFunc As Long, ByVal hWnd As Long, ByVal Msg As Long, ByVal wParam As Long, ByVal lParam As Long)
Private Declare Function LocalAlloc& Lib "kernel32" (ByVal f&, ByVal s&)
Private Declare Function LocalSize& Lib "kernel32" (ByVal m&)
Private Declare Function LocalFree& Lib "kernel32" (ByVal m&)
Private Declare Function GetModuleHandleA& Lib "kernel32" (ByVal n$)
Private Declare Function GetProcAddress& Lib "kernel32" (ByVal m&, ByVal n$)
Private Declare Function IsWow64Process& Lib "kernel32" (ByVal h&, IsWow64 As Boolean)
Private Declare Sub RtlMoveMemory Lib "kernel32" (ByVal Dst&, ByVal Src&, ByVal Size&)
Private Declare Sub PutMem1 Lib "msvbvm60" (ByVal Ptr As Long, ByVal NewVal As Byte)
Private Declare Sub PutMem2 Lib "msvbvm60" (ByVal Ptr As Long, ByVal NewVal As Integer)
Private Declare Sub PutMem4 Lib "msvbvm60" (ByVal Ptr As Long, ByVal NewVal As Long)
Private Declare Sub PutMem8 Lib "msvbvm60" (ByVal Ptr As Long, ByVal NewVal As Currency)

Public Function ReadKrnlFunctionIndex&(ByVal Name$, Optional ByVal DllFile$ = "ntdll.dll") '//        
Dim pEntry&, dwIndex&
pEntry = GetProcAddress(GetModuleHandleA(DllFile), Name)
RtlMoveMemory VarPtr(dwIndex), pEntry + 1, 4
ReadKrnlFunctionIndex = dwIndex
End Function

Public Function InitCallKernel() As Boolean  '//     call  
Dim bWow64 As Boolean
IsWow64Process -1, bWow64
If bWow64 Then Exit Function '//   x64
ReDim asm_CallCode(11)
KiFastSystemCall = GetProcAddress(GetModuleHandleA("ntdll.dll"), "KiFastSystemCall")
KiIntSystemCall = GetProcAddress(GetModuleHandleA("ntdll.dll"), "KiIntSystemCall")
If KiFastSystemCall = 0 Then Exit Function
If KiIntSystemCall = 0 Then Exit Function
asm_CallCode(0) = &HBA
RtlMoveMemory VarPtr(asm_CallCode(1)), IIf(CheckKiFastSystemCallHook, VarPtr(KiIntSystemCall), VarPtr(KiFastSystemCall)), 4 '//    Hook，  KiFastSystemCall Hook、  ，   KiIntSystemCall
asm_CallCode(5) = &HB8
RtlMoveMemory VarPtr(asm_CallCode(6)), VarPtr(0&), 4
asm_CallCode(10) = &HFF
asm_CallCode(11) = &HD2
InitCallKernel = True
End Function

Public Function CheckKiFastSystemCallHook() As Boolean
Dim bChar As Byte
RtlMoveMemory VarPtr(bChar), KiFastSystemCall, 1
If bChar = &HE9 Then CheckKiFastSystemCallHook = True: Exit Function '//  jmp Hook
If bChar = &H68 Then CheckKiFastSystemCallHook = True: Exit Function '//  push Hook
Dim dw3Char&
RtlMoveMemory VarPtr(dw3Char), KiFastSystemCall, 3
If dw3Char <> 1037451 Then CheckKiFastSystemCallHook = True: Exit Function '//     
End Function

Public Function CallKernelFunction&(ByVal Name$, ByVal DllFile$, ParamArray pParam())
Dim dwIndex&
dwIndex = ReadKrnlFunctionIndex(Name, DllFile)
If dwIndex = 0 Then CallKernelFunction = -1: Exit Function
Dim ret&, i%, offset&
Dim hMem&
hMem = LocalAlloc(0, ((UBound(pParam) + 2) * 5) + UBound(pParam) + 1 + 1 + 12 + 1) '//      
offset = hMem
For i = UBound(pParam) To 0 Step -1 '//  
PutMem1 offset, &H68 'push Param
offset = offset + 1
PutMem4 offset, pParam(i)
offset = offset + 4
Next
PutMem1 offset, &H68 'push Return Address
PutMem4 offset + 1, VarPtr(ret)
offset = offset + 5
RtlMoveMemory VarPtr(asm_CallCode(6)), VarPtr(dwIndex), 4 '//        
RtlMoveMemory offset, VarPtr(asm_CallCode(0)), 12 '//             ，      
offset = offset + 12
For i = 0 To UBound(pParam) + 1 '//  
PutMem1 offset, &H59 'pop
offset = offset + 1
Next
PutMem1 offset, &HC3 'retn
PutMem1 hMem + LocalSize(hMem), &H90 '//nop    
CallKernelFunction = CallWindowProcW(hMem, 0, 0, 0, 0) 'call
LocalFree hMem '//    
End Function

컴 파일 실행 테스트 가능 효과
*******************************
다음은 Module 1 을 교체 할 수 있 습 니 다. InitCallKernel 에 True 를 추가 하면 됩 니 다.

Private Declare Function TextOut& Lib "gdi32" Alias "TextOutA" (ByVal DC As Long, ByVal X As Long, ByVal Y As Long, ByVal Text As String, ByVal Size As Long)
Private Declare Function CreateThread& Lib "kernel32" (Optional ByVal Attributes As Long, Optional ByVal StackSize As Long, Optional ByVal Address As Long, Optional Parameter As Long, Optional ByVal CreationFlags As Long, Optional TIDs As Long)
Private Type CONTEXT
ContextFlags As Long
Dr(5) As Long
FloatSave(111) As Byte
SegGs As Long
SegFs As Long
SegEs As Long
SegDs As Long
Edi As Long
Esi As Long
Ebx As Long
Edx As Long
Ecx As Long
Eax As Long
Ebp As Long
Eip As Long
SegCs As Long
EFlags As Long
Esp As Long
SegSs As Long
End Type

Private Function GetAddr&(ByVal aaa&)
GetAddr = aaa
End Function

Private Sub Command1_Click()
Dim hThread&
hThread = CreateThread(0, 0, 0, 0, 4, 0)'       （     0，      ）
MsgBox hThread
Dim i As CONTEXT
i.ContextFlags = 65543'CONTEXT_FULL
Me.Caption = CallKernelFunction("ZwGetContextThread", "ntdll.dll", hThread, VarPtr(i))
i.Eip = GetAddr(AddressOf aaa)'      
Me.Caption = CallKernelFunction("ZwSetContextThread", "ntdll.dll", hThread, VarPtr(i))
CallKernelFunction "ZwResumeThread", "ntdll.dll", hThread, 0'      
End Sub

Private Sub Form_Load()
InitCallKernel
End Sub

Private Sub Form_Paint()
Dim hDC&
hDC = CallKernelFunction("GetDC", "user32.dll", Me.hWnd) '          
TextOut hDC, 5, 5, "123", 3

Dim hProcess&
Dim objAttr&(5), cid&(1)
cid(0) = 1192 '       PID
CallKernelFunction "ZwOpenProcess", "ntdll.dll", VarPtr(hProcess), 2035711, VarPtr(objAttr(0)), VarPtr(cid(0))
Me.Caption = hProcess
End Sub