zoukankan      html  css  js  c++  java
  • VC++实现全局钩子勾住消息对话框

    #ifndef _HOOKAPI_H 
    #define _HOOKAPI_H 
     
     
    class CHOOKAPI { 
    public: 
    	LPVOID	pOldFunEntry, pNewFunEntry ;	// 初始函数地址、HOOK后的函数地址 
    	BYTE	bOldByte[5], bNewByte[5] ;		// 原始字节、目标字节 
     
    public: 
    	CHOOKAPI () {} 
    	~CHOOKAPI() {} 
    	// 实现HOOK API 
    	void Hook ( PSTR szModuleName, PSTR szFunName, FARPROC pFun ) 
    	{	 
    		HMODULE	hMod = ::GetModuleHandleA ( szModuleName ) ; 
    		if ( hMod != NULL ) 
    		{ 
    			pNewFunEntry	= (LPVOID)pFun ; 
    			pOldFunEntry	= (LPVOID)GetProcAddress ( hMod, szFunName ) ; 
    			bNewByte[0]		= 0xE9 ; 
    			*((PDWORD)(&(bNewByte[1])))	= (DWORD)pNewFunEntry - (DWORD)pOldFunEntry - 5 ;  
     
    			DWORD   dwProtect, dwWriteByte, dwReadByte ;  
    			VirtualProtect ( (LPVOID)pOldFunEntry, 5, PAGE_READWRITE, &dwProtect ); 
    			ReadProcessMemory	( GetCurrentProcess(), (LPVOID)pOldFunEntry, bOldByte, 5, &dwReadByte ) ;		 
    			WriteProcessMemory	( GetCurrentProcess(), (LPVOID)pOldFunEntry, bNewByte, 5, &dwWriteByte ) ; 
    			VirtualProtect ( (LPVOID)pOldFunEntry, 5, dwProtect, NULL ) ; 
    		} 
    	} 
    	// 重新HOOK 
    	void ReHook () 
    	{ 
    		DWORD	dwProtect, dwWriteByte ; 
    		VirtualProtect ( pOldFunEntry, 5, PAGE_READWRITE, &dwProtect ); 
    		WriteProcessMemory ( GetCurrentProcess(), pOldFunEntry, bNewByte, 5, &dwWriteByte ) ; 
    		VirtualProtect ( pOldFunEntry, 5, dwProtect, NULL ) ; 
    	} 
    	// 撤消HOOK 
    	void UnHook () 
    	{ 
    		DWORD	dwProtect, dwWriteByte ; 
    		VirtualProtect ( pOldFunEntry, 5, PAGE_READWRITE, &dwProtect ); 
    		WriteProcessMemory ( GetCurrentProcess(), pOldFunEntry, bOldByte, 5, &dwWriteByte ) ; 
    		VirtualProtect ( pOldFunEntry, 5, dwProtect, NULL ) ; 
    	} 
    } ; 
     
    #endif




    #include <windows.h>   
    #include "HookApi.h"   
       
    CHOOKAPI    HookItem ;   
       
    // 定义MessageBoxA函数原型   
    typedef int (WINAPI* PFNMessageBoxA)( HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType ) ;   
       
    // 自定义的MessageBoxA函数   
    // 实现对原始MessageBoxA的输入、输出参数的监控,甚至是取消调用   
    int WINAPI NEW_MessageBoxA( HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType )   
    {   
        // 撤消HOOK   
        HookItem.UnHook () ;   
       
        // 此处可以观察/修改调用参数,甚至可以取消调用直接返回。   
        // ……   
       
        // 取得原函数地址   
        PFNMessageBoxA pfnMessageBoxA = (PFNMessageBoxA)HookItem.pOldFunEntry ;   
       
        // 调用原函数,修改输入参数   
        int ret = pfnMessageBoxA ( hWnd, "这是HOOK函数过程的消息框", "[测试]", uType ) ;   
       
        // 此处可以查看/修改调用原函数的返回值   
        // ……   
       
        // 重新HOOK   
        HookItem.ReHook () ;   
       
        return ret ;   
    }   
       
    int WINAPI WinMain ( HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow )   
    {   
        // 原始API   
        MessageBoxA ( 0, "正常消息框", "测试", 0 ) ;   
       
        // HOOK API   
        HookItem.Hook ( "USER32.dll", "MessageBoxA", (FARPROC)NEW_MessageBoxA ) ;   
           
        // 调用API,测试   
        MessageBoxA ( 0, "正常消息框", "测试", 0 ) ;   
       
        // 撤消HOOK   
        HookItem.UnHook () ;   
        return 0 ;   
    }   


  • 相关阅读:
    LeetCode 189. Rotate Array
    LeetCode 965. Univalued Binary Tree
    LeetCode 111. Minimum Depth of Binary Tree
    LeetCode 104. Maximum Depth of Binary Tree
    Windows下MySQL的安装与配置
    LeetCode 58. Length of Last Word
    LeetCode 41. First Missing Positive
    LeetCode 283. Move Zeroes
    《蚂蚁金服11.11:支付宝和蚂蚁花呗的技术架构及实践》读后感
    删除docker下的镜像
  • 原文地址:https://www.cnblogs.com/new0801/p/6177704.html
Copyright © 2011-2022 走看看