zoukankan
html css js c++ java
APIHOOK
#include
<
stdio.h
>
#include
<
windows.h
>
#include
<
Dbghelp.h
>
#pragma comment(lib,
"
Dbghelp.lib
"
)
#pragma comment(lib,
"
User32.lib
"
)
typedef
int
(__stdcall
*
OLD_MessageBox)( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType );
OLD_MessageBox g_procOldMessageBox
=
NULL;
int
__stdcall HOOK_MessageBox( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType)
{
printf(
"
%s %d
"
,__FUNCTION__,__LINE__);
if
(NULL
!=
g_procOldMessageBox)
return
g_procOldMessageBox(hWnd,lpText,TEXT(
"
不好意思,hook到了!
"
),uType);
else
return
MessageBox(hWnd,lpText,lpCaption,uType); ;
}
int
replace_IAT(
const
char
*
pDllName,
const
char
*
pApiName,
void
**
OldApiAddr,
void
*
NewApiAddr,
bool
bReplace)
{
HANDLE hProcess
=
::GetModuleHandle (NULL);
DWORD dwSize
=
0
;
PIMAGE_IMPORT_DESCRIPTOR pImageImport
=
(PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(hProcess,TRUE,
IMAGE_DIRECTORY_ENTRY_IMPORT,
&
dwSize);
if
(NULL
==
pImageImport)
return
1
;
PIMAGE_IMPORT_BY_NAME pImageImportByName
=
NULL;
PIMAGE_THUNK_DATA pImageThunkOriginal
=
NULL;
PIMAGE_THUNK_DATA pImageThunkReal
=
NULL;
while
(pImageImport
->
Name)
{
if
(
0
==
lstrcmpiA((
char
*
)((PBYTE)hProcess
+
pImageImport
->
Name),pDllName))
{
break
;
}
++
pImageImport;
}
if
(
!
pImageImport
->
Name)
return
2
;
pImageThunkOriginal
=
(PIMAGE_THUNK_DATA)((PBYTE)hProcess
+
pImageImport
->
OriginalFirstThunk );
pImageThunkReal
=
(PIMAGE_THUNK_DATA)((PBYTE)hProcess
+
pImageImport
->
FirstThunk );
while
(pImageThunkOriginal
->
u1.Function)
{
if
((pImageThunkOriginal
->
u1.Ordinal
&
IMAGE_ORDINAL_FLAG)
!=
IMAGE_ORDINAL_FLAG)
{
pImageImportByName
=
(PIMAGE_IMPORT_BY_NAME)((PBYTE)hProcess
+
pImageThunkOriginal
->
u1.AddressOfData );
if
(
0
==
lstrcmpiA(pApiName,(
char
*
)pImageImportByName
->
Name))
{
MEMORY_BASIC_INFORMATION mbi_thunk;
VirtualQuery(pImageThunkReal,
&
mbi_thunk,
sizeof
(MEMORY_BASIC_INFORMATION));
VirtualProtect(mbi_thunk.BaseAddress,mbi_thunk.RegionSize, PAGE_READWRITE,
&
mbi_thunk.Protect);
if
(
true
==
bReplace)
{
*
OldApiAddr
=
(
void
*
)pImageThunkReal
->
u1.Function;
pImageThunkReal
->
u1.Function
=
(DWORD)(NewApiAddr);
}
else
{
pImageThunkReal
->
u1.Function
=
(DWORD)(
*
OldApiAddr);
*
OldApiAddr = NULL;
}
DWORD dwOldProtect;
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize, mbi_thunk.Protect,
&
dwOldProtect);
break
;
}
}
++
pImageThunkOriginal;
++
pImageThunkReal;
}
return
0
;
}
int
_tmain(
int
argc, _TCHAR
*
argv[])
{
replace_IAT(
"
User32.dll
"
,
"
MessageBoxW
"
,(
void
**
)
&
g_procOldMessageBox,HOOK_MessageBox,
true
);
MessageBox(NULL,TEXT(
"
EnumIAT User32.dll MessageBoxW true;
"
),TEXT(
""
),MB_OK);
replace_IAT(
"
User32.dll
"
,
"
MessageBoxW
"
,(
void
**
)
&
g_procOldMessageBox,HOOK_MessageBox,
false
);
MessageBox(NULL,TEXT(
"
EnumIAT User32.dll MessageBoxW false;
"
),TEXT(
"
UnHook!
"
),MB_OK);
return
getchar();
return
0
;
}
查看全文
相关阅读:
DB2原因码7,解决方法
打包项目成war包并部署到服务器上,项目运行一直显示加载中
解决js中对象中属性是数组中对应元素,不能使用点数组元素(.数组[i])来获取value值来循环,属性不能是数组元素array[i]的问题
javaweb项目中jsp的from表单提交action内容与web.xml的servlet-mapping对应
Collection迭代器Iterator的使用
使用switch计算出某年某月某日是今年的第几天,输出一直是当月天数
DB2添加联合主键
您的主机中的软件中止了一个已建立的连接
java中在构造方法中修改线程名,修改失败原因(现已修改成功)
String字符串加号的作用与基本数据类型加号的作用的区别
原文地址:https://www.cnblogs.com/vcerror/p/4289245.html
最新文章
Mybatis入门
React总结二(元素渲染)
React总结一(JSX)
Fullpage.js 踩坑(滚动条)
element表格自定义表头数据不更新的问题
用 moment 实现获取本周、前n周、后 n 周开始结束日期
二、ts 面向对象编程(简易版)
canvas画图在移动端模糊解决方法
当使用canvas背景动画时,移动端无法滑动页面
Frontend Developer
热门文章
es6 some every
promise
ES6 map数据结构
项目记录
vue-cli3 创建项目 与初始配置
文件路径
时间戳转化
vue slot
webpack
vue组件间的数值传递
Copyright © 2011-2022 走看看