LPCBYTE Ptr = (LPCBYTE)GetModuleHandle(NULL); PIMAGE_NT_HEADER Pnt = (PIMAGE_NT_HEADER)(Ptr + ((PIMAGE_DOS_HEADER)Ptr)->e_lfanew); PIMAGE_IMPORT_DESCRIPTOR ImpDir = (PIMAGE_IMPORT_DESCRIPTOR)(Ptr + Pnt->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]); for( ; ImpDir->Name; ImpDir++) if(!lstrcmpiA(Ptr + ImpDir->Name, "kernel32.dll") goto found1; return(FALSE); found1: LPDWORD pIAT = (LPDWORD)(Ptr + ImpDir->FirstThunk); LPDWORD pINT = (LPDWORD)(Ptr + ImpDir->OriginalFirstThunk); for( ;*pIAT; pIAT++, pINT++) { if((long)*pINT < 0) continue; if(!lstrcmpiA(((PIMAGE_IMPORT_BY_NAME)(Ptr + *pINT))->Name, "ReadConsoleA") goto found2; } return(FALSE); found2: LPDWORD pCall = (LPDWORD)(Ptr + *pIAT); MEMORY_BASIC_INFORMATION mi; DWORD dummy; if( VirtualQuery(pCall, &mi, sizeof(mi) != sizeof(mi) || (LPCBYTE)mi.AllocationBase + mi.RegionSize < &pCall[1]) return(FALSE); //Paranoja if(mi.Protect == PAGE_READONLY) { if(!VirtualProtect(mi.AllocationBase, mi.RegionSize, PAGE_READWRITE, &dummy)) return(FALSE); //Paranoja } *pIAT = (DWORD)MyReplacerOfReadConsole; if(mi.Protect == PAGE_READONLY) VirtualProtect(mi.AllocationBase, mi.RegionSize, PAGE_REANONLY, &dummy); return(TRUE);