zoukankan
html css js c++ java
APIHOOK
#include
<
stdio.h
>
#include
<
windows.h
>
#include
<
Dbghelp.h
>
#pragma comment(lib,
"
Dbghelp.lib
"
)
#pragma comment(lib,
"
User32.lib
"
)
typedef
int
(__stdcall
*
OLD_MessageBox)( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType );
OLD_MessageBox g_procOldMessageBox
=
NULL;
int
__stdcall HOOK_MessageBox( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType)
{
printf(
"
%s %d
"
,__FUNCTION__,__LINE__);
if
(NULL
!=
g_procOldMessageBox)
return
g_procOldMessageBox(hWnd,lpText,TEXT(
"
不好意思,hook到了!
"
),uType);
else
return
MessageBox(hWnd,lpText,lpCaption,uType); ;
}
int
replace_IAT(
const
char
*
pDllName,
const
char
*
pApiName,
void
**
OldApiAddr,
void
*
NewApiAddr,
bool
bReplace)
{
HANDLE hProcess
=
::GetModuleHandle (NULL);
DWORD dwSize
=
0
;
PIMAGE_IMPORT_DESCRIPTOR pImageImport
=
(PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(hProcess,TRUE,
IMAGE_DIRECTORY_ENTRY_IMPORT,
&
dwSize);
if
(NULL
==
pImageImport)
return
1
;
PIMAGE_IMPORT_BY_NAME pImageImportByName
=
NULL;
PIMAGE_THUNK_DATA pImageThunkOriginal
=
NULL;
PIMAGE_THUNK_DATA pImageThunkReal
=
NULL;
while
(pImageImport
->
Name)
{
if
(
0
==
lstrcmpiA((
char
*
)((PBYTE)hProcess
+
pImageImport
->
Name),pDllName))
{
break
;
}
++
pImageImport;
}
if
(
!
pImageImport
->
Name)
return
2
;
pImageThunkOriginal
=
(PIMAGE_THUNK_DATA)((PBYTE)hProcess
+
pImageImport
->
OriginalFirstThunk );
pImageThunkReal
=
(PIMAGE_THUNK_DATA)((PBYTE)hProcess
+
pImageImport
->
FirstThunk );
while
(pImageThunkOriginal
->
u1.Function)
{
if
((pImageThunkOriginal
->
u1.Ordinal
&
IMAGE_ORDINAL_FLAG)
!=
IMAGE_ORDINAL_FLAG)
{
pImageImportByName
=
(PIMAGE_IMPORT_BY_NAME)((PBYTE)hProcess
+
pImageThunkOriginal
->
u1.AddressOfData );
if
(
0
==
lstrcmpiA(pApiName,(
char
*
)pImageImportByName
->
Name))
{
MEMORY_BASIC_INFORMATION mbi_thunk;
VirtualQuery(pImageThunkReal,
&
mbi_thunk,
sizeof
(MEMORY_BASIC_INFORMATION));
VirtualProtect(mbi_thunk.BaseAddress,mbi_thunk.RegionSize, PAGE_READWRITE,
&
mbi_thunk.Protect);
if
(
true
==
bReplace)
{
*
OldApiAddr
=
(
void
*
)pImageThunkReal
->
u1.Function;
pImageThunkReal
->
u1.Function
=
(DWORD)(NewApiAddr);
}
else
{
pImageThunkReal
->
u1.Function
=
(DWORD)(
*
OldApiAddr);
*
OldApiAddr = NULL;
}
DWORD dwOldProtect;
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize, mbi_thunk.Protect,
&
dwOldProtect);
break
;
}
}
++
pImageThunkOriginal;
++
pImageThunkReal;
}
return
0
;
}
int
_tmain(
int
argc, _TCHAR
*
argv[])
{
replace_IAT(
"
User32.dll
"
,
"
MessageBoxW
"
,(
void
**
)
&
g_procOldMessageBox,HOOK_MessageBox,
true
);
MessageBox(NULL,TEXT(
"
EnumIAT User32.dll MessageBoxW true;
"
),TEXT(
""
),MB_OK);
replace_IAT(
"
User32.dll
"
,
"
MessageBoxW
"
,(
void
**
)
&
g_procOldMessageBox,HOOK_MessageBox,
false
);
MessageBox(NULL,TEXT(
"
EnumIAT User32.dll MessageBoxW false;
"
),TEXT(
"
UnHook!
"
),MB_OK);
return
getchar();
return
0
;
}
查看全文
相关阅读:
PyQt(Python+Qt)学习随笔:QMdiArea多文档界面区域的viewMode、documentMode、tabsClosable、tabPosition等属性介绍
书籍收藏
通用经验:大企业如何逆势而上
T 恤
柳传志:做企业家还是政治家
管理最大的挑战是怎么激活人,尤其是激发年轻人
张瑞敏:企业要长“第三只眼”
软件就是未来:工业4.0时代下的工业软件
软件:工业的未来
poj 3422 Kaka's Matrix Travels 费用流
原文地址:https://www.cnblogs.com/vcerror/p/4289244.html
最新文章
2018.12.20 L195
day10,11练习
MySQL主从同步原理
day10,11-Python 基本数据类型介绍之数字与字符串(看看就好)
day3-创建列表、元祖、字典
day2-安装python以及基本使用
day1-pycharm使用
DNS原理-HTTP原理-TCP原理
nginx如何安装第三方模块
nginx之十三:搭建 nginx 反向代理用做内网域名转发
热门文章
nginx之七:nginx path(root)文件路径配置
PyQt学习随笔:自定义信号连接时报AttributeError: 'PyQt5.QtCore.pyqtSignal' object has no attribute 'connect'
PyQt(Python+Qt)学习随笔:自定义信号在emit发射信号时报错:AttributeError: object has no attribute
PyQt(Python+Qt)学习随笔:利用QWidget部件的palette以及ColorGroup、colorRole局部调整部件的特定范围颜色
PyQt学习随笔:QWidget的QFont的kerning、Antialiasing属性用途
PyQt(Python+Qt)学习随笔:QWidget部件的palette属性以及ColorGroup、colorRole的用途和含义
PyQt(Python+Qt)学习随笔:使用QColorDialog.getColor交互设置部件的颜色
PyQt(Python+Qt)学习随笔:使用QFontDialog.getFont交互设置应用或部件的字体
第15.37节 PyQt(Python+Qt)入门学习:containers容器类部件QMdiArea多文档界面部件详解及编程开发案例
PyQt(Python+Qt)学习随笔:QMdiArea多文档界面部件的subWindowActivated信号
Copyright © 2011-2022 走看看