Injection Code in Import table (ii)

What do you call it?

This time I want to use this technology to change the function of an API. I'm not sure if we can call it API redirection again. In this example, I redirect the CALC.EXE shellabout () dialog box to my "Hello world!" Message box (in Pemaker7.zip). You will see how easily you can implement it with the aforementioned code and make very few changes.

...
//================================================================
Push EDI
Push ESI
Push EBX
MOV ebx,[ebp-10h]
Push EBX
Push EBX
Call _char_upper
MOV esi,[ebp-10h]
MOV edi,[ebp+010h]//[ebp+_p_szshell32]
_it_fixup_1_check_dll_redirected:
Push EDI
Call __strlen
Add ESP, 4
MOV ebx,eax
MOV ecx,eax
Push EDI
Push ESI
Repe cmps//byte ptr [edi], byte ptr [esi]
JZ _it_fixup_1_check_func_name
JMP _it_fixup_1_no_check_func_name
_it_fixup_1_check_func_name:
MOV edi,[ebp+014h]//[ebp+_p_szshellabout]
Push EDI
Call __strlen
Add ESP, 4
MOV ecx,eax
MOV esi,[ebp-18h]
MOV edi,[ebp+014h]//[ebp+_p_szshellabout]
Repe cmps//byte ptr [edi], byte ptr [esi]
JZ _it_fixup_1_do_normal_it_0
_it_fixup_1_no_check_func_name:
Pop esi
Pop EDI
Add EDI,EBX
CMP byte ptr [edi],0
JNZ _it_fixup_1_check_dll_redirected
MOV ecx,[ebp-08h]
MOV eax,[ebp-014h]
mov [ecx],eax
JMP _it_fixup_1_do_normal_it_1
_IT_FIXUP_1_DO_NORMAL_IT_0:
Pop esi
Pop EDI
MOV ecx,[ebp-08h]
MOV edi,[ebp+18h]
mov [ecx],edi//the new function to the thunk
_it_fixup_1_do_normal_it_1:
Pop ebx
Pop esi
Pop EDI
//================================================================
...