zoukankan
html css js c++ java
APIHOOK
#include
<
stdio.h
>
#include
<
windows.h
>
#include
<
Dbghelp.h
>
#pragma comment(lib,
"
Dbghelp.lib
"
)
#pragma comment(lib,
"
User32.lib
"
)
typedef
int
(__stdcall
*
OLD_MessageBox)( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType );
OLD_MessageBox g_procOldMessageBox
=
NULL;
int
__stdcall HOOK_MessageBox( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType)
{
printf(
"
%s %d
"
,__FUNCTION__,__LINE__);
if
(NULL
!=
g_procOldMessageBox)
return
g_procOldMessageBox(hWnd,lpText,TEXT(
"
不好意思,hook到了!
"
),uType);
else
return
MessageBox(hWnd,lpText,lpCaption,uType); ;
}
int
replace_IAT(
const
char
*
pDllName,
const
char
*
pApiName,
void
**
OldApiAddr,
void
*
NewApiAddr,
bool
bReplace)
{
HANDLE hProcess
=
::GetModuleHandle (NULL);
DWORD dwSize
=
0
;
PIMAGE_IMPORT_DESCRIPTOR pImageImport
=
(PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(hProcess,TRUE,
IMAGE_DIRECTORY_ENTRY_IMPORT,
&
dwSize);
if
(NULL
==
pImageImport)
return
1
;
PIMAGE_IMPORT_BY_NAME pImageImportByName
=
NULL;
PIMAGE_THUNK_DATA pImageThunkOriginal
=
NULL;
PIMAGE_THUNK_DATA pImageThunkReal
=
NULL;
while
(pImageImport
->
Name)
{
if
(
0
==
lstrcmpiA((
char
*
)((PBYTE)hProcess
+
pImageImport
->
Name),pDllName))
{
break
;
}
++
pImageImport;
}
if
(
!
pImageImport
->
Name)
return
2
;
pImageThunkOriginal
=
(PIMAGE_THUNK_DATA)((PBYTE)hProcess
+
pImageImport
->
OriginalFirstThunk );
pImageThunkReal
=
(PIMAGE_THUNK_DATA)((PBYTE)hProcess
+
pImageImport
->
FirstThunk );
while
(pImageThunkOriginal
->
u1.Function)
{
if
((pImageThunkOriginal
->
u1.Ordinal
&
IMAGE_ORDINAL_FLAG)
!=
IMAGE_ORDINAL_FLAG)
{
pImageImportByName
=
(PIMAGE_IMPORT_BY_NAME)((PBYTE)hProcess
+
pImageThunkOriginal
->
u1.AddressOfData );
if
(
0
==
lstrcmpiA(pApiName,(
char
*
)pImageImportByName
->
Name))
{
MEMORY_BASIC_INFORMATION mbi_thunk;
VirtualQuery(pImageThunkReal,
&
mbi_thunk,
sizeof
(MEMORY_BASIC_INFORMATION));
VirtualProtect(mbi_thunk.BaseAddress,mbi_thunk.RegionSize, PAGE_READWRITE,
&
mbi_thunk.Protect);
if
(
true
==
bReplace)
{
*
OldApiAddr
=
(
void
*
)pImageThunkReal
->
u1.Function;
pImageThunkReal
->
u1.Function
=
(DWORD)(NewApiAddr);
}
else
{
pImageThunkReal
->
u1.Function
=
(DWORD)(
*
OldApiAddr);
*
OldApiAddr = NULL;
}
DWORD dwOldProtect;
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize, mbi_thunk.Protect,
&
dwOldProtect);
break
;
}
}
++
pImageThunkOriginal;
++
pImageThunkReal;
}
return
0
;
}
int
_tmain(
int
argc, _TCHAR
*
argv[])
{
replace_IAT(
"
User32.dll
"
,
"
MessageBoxW
"
,(
void
**
)
&
g_procOldMessageBox,HOOK_MessageBox,
true
);
MessageBox(NULL,TEXT(
"
EnumIAT User32.dll MessageBoxW true;
"
),TEXT(
""
),MB_OK);
replace_IAT(
"
User32.dll
"
,
"
MessageBoxW
"
,(
void
**
)
&
g_procOldMessageBox,HOOK_MessageBox,
false
);
MessageBox(NULL,TEXT(
"
EnumIAT User32.dll MessageBoxW false;
"
),TEXT(
"
UnHook!
"
),MB_OK);
return
getchar();
return
0
;
}
查看全文
相关阅读:
iOS多线程开发小demo5 线程间的通信
iOS多线程开发小demo4,线程的同步问题
iOS多线程开发小demo3,线程的状态
iOS多线程开发小demo2,NSThread篇
iOS多线程开发小demo
iOS开发多线程基础知识
sublime text 3 3083 注册码
Canvas现实画板功能
CSS3动画进度条
移动端使用HTML5表单增强体验
原文地址:https://www.cnblogs.com/vcerror/p/4289244.html
最新文章
学习IOS开发UI篇--UITableView中Cell的创建方式总结
学习IOS开发UI篇--Quartz2D基本绘图
学习IOS开发UI篇--Modal跳转
学习IOS开发UI篇--数据存储
学习IOS开发UI篇--UITabBarController
学习IOS开发UI篇--UINavigationController/Segue
git分支操作
这可耻的成熟
转载:公历,农历相关的历法知识
iOS 屏幕适配,autoResizing autoLayout和sizeClass图文详解
热门文章
cocoapods的安装使用
swift学习笔记
iOS-app发布证书和调试证书配置
markdown的使用说明
iOS指向函数的指针和block
ios-UIWebView中js和oc代码的互调
iOs开发 单例模式 省懒宏
iOS开发多线程基础知识 NSOperation
iOS多线程开发小demo7 GCD队列组
iOS多线程开发小demo6 GCD
Copyright © 2011-2022 走看看