DWORD _myCreate;

void BackupDll()
{
    MODULEINFO    Mdl_Info;
    LPVOID        lpNewDLL    =    NULL;
    ZeroMemory(&Mdl_Info,sizeof(Mdl_Info));
    // 获取模块信息
    GetModuleInformation(GetCurrentProcess(),GetModuleHandle(L"kernel32"), &Mdl_Info, sizeof(Mdl_Info));
    lpNewDLL = VirtualAllocEx(
        GetCurrentProcess(),
        NULL,
        Mdl_Info.SizeOfImage,
        MEM_COMMIT|MEM_RESERVE,
        PAGE_EXECUTE_READWRITE
        );
    if (lpNewDLL == NULL)
        return;
    if (!WriteProcessMemory(GetCurrentProcess(), lpNewDLL, Mdl_Info.lpBaseOfDll, Mdl_Info.SizeOfImage, NULL))
    {
        VirtualFreeEx(GetCurrentProcess(),lpNewDLL,Mdl_Info.SizeOfImage,MEM_DECOMMIT);
        return;
    }
    _myCreate = (DWORD)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "CreateFileW") - (DWORD)Mdl_Info.lpBaseOfDll + (DWORD)lpNewDLL;
}

HANDLE WINAPI MyCreateFileW(__in LPCWSTR lpFileName, __in DWORD dwDesiredAccess, __in DWORD dwShareMode, 
    __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes, __in DWORD dwCreationDisposition, 
    __in DWORD dwFlagsAndAttributes, __in_opt HANDLE hTemplateFile)
{
    typedef HANDLE WINAPI CREATE(__in LPCWSTR lpFileName, __in DWORD dwDesiredAccess, __in DWORD dwShareMode, 
        __in_opt LPSECURITY_ATTRIBUTES lpSecurityAttributes, __in DWORD dwCreationDisposition, 
        __in DWORD dwFlagsAndAttributes, __in_opt HANDLE hTemplateFile);
    CREATE* pCreate=(CREATE*)_myCreate;
    return pCreate(lpFileName,dwDesiredAccess,dwShareMode,lpSecurityAttributes,dwCreationDisposition,dwFlagsAndAttributes,hTemplateFile);
}

//DLL操作
        LPVOID _pCreate=(PVOID)GetProcAddress(GetModuleHandle(L"kernel32.dll"), "CreateFileW");
        BYTE New_Code2[7];
        DWORD _JmpAddr=(DWORD)MyCreateFileW;
        if (NULL==_pCreate)
            return 5;
        New_Code2[0] = 0xB8;
        memcpy(&New_Code2[1],&_JmpAddr,4);
        New_Code2[5] = 0xFF;
        New_Code2[6] = 0xE0;
        if (!WriteProcessMemory(GetCurrentProcess(),_pCreate,New_Code2,sizeof(New_Code2),NULL))
            return 6;
        return 0;