zoukankan
html css js c++ java
APIHOOK
#include
<
stdio.h
>
#include
<
windows.h
>
#include
<
Dbghelp.h
>
#pragma comment(lib,
"
Dbghelp.lib
"
)
#pragma comment(lib,
"
User32.lib
"
)
typedef
int
(__stdcall
*
OLD_MessageBox)( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType );
OLD_MessageBox g_procOldMessageBox
=
NULL;
int
__stdcall HOOK_MessageBox( HWND hWnd, LPCTSTR lpText, LPCTSTR lpCaption,UINT uType)
{
printf(
"
%s %d
"
,__FUNCTION__,__LINE__);
if
(NULL
!=
g_procOldMessageBox)
return
g_procOldMessageBox(hWnd,lpText,TEXT(
"
不好意思,hook到了!
"
),uType);
else
return
MessageBox(hWnd,lpText,lpCaption,uType); ;
}
int
replace_IAT(
const
char
*
pDllName,
const
char
*
pApiName,
void
**
OldApiAddr,
void
*
NewApiAddr,
bool
bReplace)
{
HANDLE hProcess
=
::GetModuleHandle (NULL);
DWORD dwSize
=
0
;
PIMAGE_IMPORT_DESCRIPTOR pImageImport
=
(PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(hProcess,TRUE,
IMAGE_DIRECTORY_ENTRY_IMPORT,
&
dwSize);
if
(NULL
==
pImageImport)
return
1
;
PIMAGE_IMPORT_BY_NAME pImageImportByName
=
NULL;
PIMAGE_THUNK_DATA pImageThunkOriginal
=
NULL;
PIMAGE_THUNK_DATA pImageThunkReal
=
NULL;
while
(pImageImport
->
Name)
{
if
(
0
==
lstrcmpiA((
char
*
)((PBYTE)hProcess
+
pImageImport
->
Name),pDllName))
{
break
;
}
++
pImageImport;
}
if
(
!
pImageImport
->
Name)
return
2
;
pImageThunkOriginal
=
(PIMAGE_THUNK_DATA)((PBYTE)hProcess
+
pImageImport
->
OriginalFirstThunk );
pImageThunkReal
=
(PIMAGE_THUNK_DATA)((PBYTE)hProcess
+
pImageImport
->
FirstThunk );
while
(pImageThunkOriginal
->
u1.Function)
{
if
((pImageThunkOriginal
->
u1.Ordinal
&
IMAGE_ORDINAL_FLAG)
!=
IMAGE_ORDINAL_FLAG)
{
pImageImportByName
=
(PIMAGE_IMPORT_BY_NAME)((PBYTE)hProcess
+
pImageThunkOriginal
->
u1.AddressOfData );
if
(
0
==
lstrcmpiA(pApiName,(
char
*
)pImageImportByName
->
Name))
{
MEMORY_BASIC_INFORMATION mbi_thunk;
VirtualQuery(pImageThunkReal,
&
mbi_thunk,
sizeof
(MEMORY_BASIC_INFORMATION));
VirtualProtect(mbi_thunk.BaseAddress,mbi_thunk.RegionSize, PAGE_READWRITE,
&
mbi_thunk.Protect);
if
(
true
==
bReplace)
{
*
OldApiAddr
=
(
void
*
)pImageThunkReal
->
u1.Function;
pImageThunkReal
->
u1.Function
=
(DWORD)(NewApiAddr);
}
else
{
pImageThunkReal
->
u1.Function
=
(DWORD)(
*
OldApiAddr);
*
OldApiAddr = NULL;
}
DWORD dwOldProtect;
VirtualProtect(mbi_thunk.BaseAddress, mbi_thunk.RegionSize, mbi_thunk.Protect,
&
dwOldProtect);
break
;
}
}
++
pImageThunkOriginal;
++
pImageThunkReal;
}
return
0
;
}
int
_tmain(
int
argc, _TCHAR
*
argv[])
{
replace_IAT(
"
User32.dll
"
,
"
MessageBoxW
"
,(
void
**
)
&
g_procOldMessageBox,HOOK_MessageBox,
true
);
MessageBox(NULL,TEXT(
"
EnumIAT User32.dll MessageBoxW true;
"
),TEXT(
""
),MB_OK);
replace_IAT(
"
User32.dll
"
,
"
MessageBoxW
"
,(
void
**
)
&
g_procOldMessageBox,HOOK_MessageBox,
false
);
MessageBox(NULL,TEXT(
"
EnumIAT User32.dll MessageBoxW false;
"
),TEXT(
"
UnHook!
"
),MB_OK);
return
getchar();
return
0
;
}
查看全文
相关阅读:
删除文件目录的两种方式
求两个整数的最大公约数?
MemCache在Windows环境下的搭建及启动
hello cnblogs
Extjs gridPanel可复制配置(转)
命令模式、状态模式、责任链模式区别(转)
UML类图几种关系的总结(转)
观察者模式(转)
Java之建造者模式(Builder Pattern)(转)
Java设计模式之工厂方法模式(转) 实现是抽象工厂?
原文地址:https://www.cnblogs.com/vcerror/p/4289245.html
最新文章
Writing Science 笔记 6.19
Writing Science 笔记 6.20
tinyxml开源库的基本用法
windows下protobuf jar包的编译
<转>libjpeg解码内存中的jpeg数据
owner:轻松管理java项目配置
Linux操作命令和工具使用
Linux两台服务器mysql数据库同步
Linux 时间同步
【Unity3D】AR应用中,关于东南西北方位的判断。
热门文章
【CityHunter】Unity3D设计AR探索模式
【CityHunter】通过Unity3D来制作游戏中AR部分的内容
【CityHunter】服务器端设计思路
【CityHunter】游戏进度总控,及需求设计
【CityHunter】基于LBS的AR体感游戏设计理念
Linux下 rz 和 sz 命令的安装与使用
CentOS下Redis的安装
VMware下CenOS7系统的安装及lnmp服务器的搭建
curl之采集QQ空间留言
Yii2之控制台命令篇(console)
Copyright © 2011-2022 走看看