hook api的一个自己写的例子

王朝vc·作者佚名  2006-01-09
窄屏简体版  字體: |||超大  

帮同学写了个hook api的例子程序,顺便post到这儿,免得将来到处找.

一个简单的console工程,vc6,vc7在win2k pro,server上调试通过.

#include <stdio.h>

#include <windows.h>

#include <Dbghelp.h>

#pragma comment(lib,"Dbghelp.lib")

#pragma comment(lib,"User32.lib")

typedef int (__stdcall *OLD_MessageBox)( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType );

OLD_MessageBox g_procOldMessageBox = NULL;

int __stdcall HOOK_MessageBox( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType)

{

printf("%s\t%d\r\n",__FUNCTION__,__LINE__);

if (NULL != g_procOldMessageBox)

return g_procOldMessageBox(hWnd,lpText,"不好意思,hook到了!",uType);

else

return MessageBox(hWnd,lpText,lpCaption,uType); ;

}

int replace_IAT(const char *pDllName,const char *pApiName,bool bReplace)

{

HANDLE hProcess = ::GetModuleHandle (NULL);

DWORD dwSize = 0;

PIMAGE_IMPORT_DESCRIPTOR pImageImport = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(hProcess,TRUE,

IMAGE_DIRECTORY_ENTRY_IMPORT,&dwSize);

if (NULL == pImageImport)

return 1;

PIMAGE_IMPORT_BY_NAME pImageImportByName = NULL;

PIMAGE_THUNK_DATA pImageThunkOriginal = NULL;

PIMAGE_THUNK_DATA pImageThunkReal = NULL;

while (pImageImport->Name)

{

if (0 == strcmpi((char*)((PBYTE)hProcess+pImageImport->Name),pDllName))

{

break;

}

++pImageImport;

}

if (! pImageImport->Name)

return 2;

pImageThunkOriginal = (PIMAGE_THUNK_DATA)((PBYTE)hProcess+pImageImport->OriginalFirstThunk );

pImageThunkReal = (PIMAGE_THUNK_DATA)((PBYTE)hProcess+pImageImport->FirstThunk );

while (pImageThunkOriginal->u1.Function)

{

if ((pImageThunkOriginal->u1 .Ordinal & IMAGE_ORDINAL_FLAG) != IMAGE_ORDINAL_FLAG)

{

pImageImportByName = (PIMAGE_IMPORT_BY_NAME)((PBYTE)hProcess+pImageThunkOriginal->u1 .AddressOfData );

if (0 == strcmpi(pApiName,(char*)pImageImportByName->Name))

{

MEMORY_BASIC_INFORMATION mbi_thunk;

VirtualQuery(pImageThunkReal, &mbi_thunk, sizeof(MEMORY_BASIC_INFORMATION));

VirtualProtect(mbi_thunk.BaseAddress,mbi_thunk.RegionSize, PAGE_READWRITE, &mbi_thunk.Protect);

if (true == bReplace)

{

g_procOldMessageBox =(OLD_MessageBox) pImageThunkReal->u1.Function;

pImageThunkReal->u1.Function = (DWORD)HOOK_MessageBox;

}

else

pImageThunkReal->u1.Function = (DWORD)g_procOldMessageBox;

DWORD dwOldProtect;

VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize, mbi_thunk.Protect, &dwOldProtect);

break;

}

}

++pImageThunkOriginal;

++pImageThunkReal;

}

return 0;

}

int main()

{

replace_IAT("User32.dll","MessageBoxA",true);

MessageBox(NULL,"EnumIAT User32.dll MessageBoxA true;","",MB_OK);

replace_IAT("User32.dll","MessageBoxA",false);

MessageBox(NULL,"EnumIAT User32.dll MessageBoxA false;","",MB_OK);

return getchar();

}

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
© 2005- 王朝網路 版權所有 導航