zoukankan
html css js c++ java
APIHOOK
#include
<
stdio.h
>
#include
<
windows.h
>
#include
<
Dbghelp.h
>
#pragma comment(lib,
"
Dbghelp.lib
"
)
#pragma comment(lib,
"
User32.lib
"
)
typedef
int
(__stdcall
*
OLD_MessageBox)( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType );
OLD_MessageBox g_procOldMessageBox
=
NULL;
int
__stdcall HOOK_MessageBox( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType)
{
printf(
"
%s %d
"
,__FUNCTION__,__LINE__);
if
(NULL
!=
g_procOldMessageBox)
return
g_procOldMessageBox(hWnd,lpText,TEXT(
"
不好意思,hook到了!
"
),uType);
else
return
MessageBox(hWnd,lpText,lpCaption,uType); ;
}
int
replace_IAT(
const
char
*
pDllName,
const
char
*
pApiName,
void
**
OldApiAddr,
void
*
NewApiAddr,
bool
bReplace)
{
HANDLE hProcess
=
::GetModuleHandle (NULL);
DWORD dwSize
=
0
;
PIMAGE_IMPORT_DESCRIPTOR pImageImport
=
(PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(hProcess,TRUE,
IMAGE_DIRECTORY_ENTRY_IMPORT,
&
dwSize);
if
(NULL
==
pImageImport)
return
1
;
PIMAGE_IMPORT_BY_NAME pImageImportByName
=
NULL;
PIMAGE_THUNK_DATA pImageThunkOriginal
=
NULL;
PIMAGE_THUNK_DATA pImageThunkReal
=
NULL;
while
(pImageImport
->
Name)
{
if
(
0
==
lstrcmpiA((
char
*
)((PBYTE)hProcess
+
pImageImport
->
Name),pDllName))
{
break
;
}
++
pImageImport;
}
if
(
!
pImageImport
->
Name)
return
2
;
pImageThunkOriginal
=
(PIMAGE_THUNK_DATA)((PBYTE)hProcess
+
pImageImport
->
OriginalFirstThunk );
pImageThunkReal
=
(PIMAGE_THUNK_DATA)((PBYTE)hProcess
+
pImageImport
->
FirstThunk );
while
(pImageThunkOriginal
->
u1.Function)
{
if
((pImageThunkOriginal
->
u1.Ordinal
&
IMAGE_ORDINAL_FLAG)
!=
IMAGE_ORDINAL_FLAG)
{
pImageImportByName
=
(PIMAGE_IMPORT_BY_NAME)((PBYTE)hProcess
+
pImageThunkOriginal
->
u1.AddressOfData );
if
(
0
==
lstrcmpiA(pApiName,(
char
*
)pImageImportByName
->
Name))
{
MEMORY_BASIC_INFORMATION mbi_thunk;
VirtualQuery(pImageThunkReal,
&
mbi_thunk,
sizeof
(MEMORY_BASIC_INFORMATION));
VirtualProtect(mbi_thunk.BaseAddress,mbi_thunk.RegionSize, PAGE_READWRITE,
&
mbi_thunk.Protect);
if
(
true
==
bReplace)
{
*
OldApiAddr
=
(
void
*
)pImageThunkReal
->
u1.Function;
pImageThunkReal
->
u1.Function
=
(DWORD)(NewApiAddr);
}
else
{
pImageThunkReal
->
u1.Function
=
(DWORD)(
*
OldApiAddr);
*
OldApiAddr = NULL;
}
DWORD dwOldProtect;
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize, mbi_thunk.Protect,
&
dwOldProtect);
break
;
}
}
++
pImageThunkOriginal;
++
pImageThunkReal;
}
return
0
;
}
int
_tmain(
int
argc, _TCHAR
*
argv[])
{
replace_IAT(
"
User32.dll
"
,
"
MessageBoxW
"
,(
void
**
)
&
g_procOldMessageBox,HOOK_MessageBox,
true
);
MessageBox(NULL,TEXT(
"
EnumIAT User32.dll MessageBoxW true;
"
),TEXT(
""
),MB_OK);
replace_IAT(
"
User32.dll
"
,
"
MessageBoxW
"
,(
void
**
)
&
g_procOldMessageBox,HOOK_MessageBox,
false
);
MessageBox(NULL,TEXT(
"
EnumIAT User32.dll MessageBoxW false;
"
),TEXT(
"
UnHook!
"
),MB_OK);
return
getchar();
return
0
;
}
查看全文
相关阅读:
excel 2003系列
DataTab转换XML XML转换DataTable 的类[转]
全角转半角与半角转全角
Day2
Day6 && Day7图论
Day1
Android为何以及如何保存Fragment实例
Android应用的本地化及知识拓展之配置修饰符
Leetcode NO.136 Single Number 只出现一次的数字
经典排序算法(四) —— Quick Sort 快速排序
原文地址:https://www.cnblogs.com/vcerror/p/4289244.html
最新文章
Zen Coding 让 Notepad++ 代码书写健步如飞
属性
[Hadoop] Yarn & k8s
团队博客(15)
团队博客(16)
团队博客(19)
团队博客(17)
站立会议报告(10)
团队博客(18)
团队博客(14)
热门文章
站立会议报告(11)
站立会议报告(9)
站立会议报告(12)
委托/事件
C#中使用SQLite数据库
如何计算冲突域和广播域图解分析
SQL2000 安装,挂起
Visual studio 配置文件下载
240多个jQuery插件
在口上打对钩√
Copyright © 2011-2022 走看看