HOOK WINDOWS API 一例

// godll.cpp : 定义 DLL 应用程序的入口点。 // #include "stdafx.h" #include <IMAGEHLP.H> #pragma comment(lib,"ImageHlp.lib") #pragma data_seg(".mydata") POINT g_point; int g_px=-1; int g_py=-1; #pragma data_seg() #pragma comment(linker, "/SECTION:.mydata,rws") HANDLE g_hInstance = NULL; PROC bak_addr = NULL; BOOL WINAPI MyGetCursorPos( LPPOINT lpPoint // address of structure for cursor position ){ if(g_px == -1 ){ typedef BOOL (WINAPI *OldGetCursorPosFun)(LPPOINT); OldGetCursorPosFun ofun = (OldGetCursorPosFun)bak_addr; ofun(lpPoint); }else{ lpPoint->x = g_px; lpPoint->y = g_py; } return TRUE; } extern "C" __declspec(dllexport) void GetPoint(LPPOINT p){ p->x = g_px; p->y = g_py; } extern "C" __declspec(dllexport) void SetPoint(LPPOINT p){ g_px = p->x; g_py = p->y; } //hook api //PCSTR modelStr : model 名称. 如 NULL 、 objsys.dll //PCSTR byHookDllStr: model 内的 dll 名称. 如User32.dll //PCSTR byHookFunStr: 被hook api 的名称 //PROC pfnNew : 替代函数的地址 //返回旧函数 的址。 //extern "C" __declspec(dllexport) PROC HookApi(PCSTR modelStr , PCSTR byHookDllStr , PCSTR byHookFunStr , PROC pfnNew){ //读取 model 基地址 LPVOID base = (LPVOID)GetModuleHandleA(modelStr); if(base == NULL){ //MessageBoxA(NULL,"find model base addr err!",modelStr,0); return NULL; } //找到该 dll 的IAT ULONG ulSize; PIMAGE_IMPORT_DESCRIPTOR pImportTable = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(base,TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT,&ulSize); if( pImportTable == NULL ){ MessageBox(NULL,L"pImportTable is null",NULL,0); return NULL; } //在 ImportTable 中 找到需要 hook 的 dll for(;pImportTable->Name;pImportTable++){ PSTR pszModName = (PSTR) ( (PBYTE)base + pImportTable->Name ); if( lstrcmpiA( pszModName, byHookDllStr ) == 0 ) break ; // if found } if( pImportTable->Name == 0 ){ MessageBoxA(NULL,"not found by hook dll. ",byHookDllStr,0); return NULL; } PIMAGE_THUNK_DATA pOrigThunk = (PIMAGE_THUNK_DATA)((PBYTE)base + pImportTable->OriginalFirstThunk); PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA) ( (PBYTE)base + pImportTable->FirstThunk ); for( ;pThunk->u1.Function;pThunk++,pOrigThunk++){ PROC *ppfnEntry = (PROC*) &(pThunk->u1.Function); PROC bak = (PROC)(*ppfnEntry); PIMAGE_IMPORT_BY_NAME pByName =(PIMAGE_IMPORT_BY_NAME)((PBYTE)base + pOrigThunk->u1.AddressOfData); if(lstrcmpiA((char*)pByName->Name , byHookFunStr) == 0) { MEMORY_BASIC_INFORMATION memInfo; VirtualQuery( ppfnEntry, &memInfo, sizeof( memInfo )); DWORD dwOldProtect = 0; if(VirtualProtect(memInfo.BaseAddress,memInfo.RegionSize,PAGE_READWRITE,&dwOldProtect)==0){ MessageBox(NULL,L"VirtualProtect[1] is Err!",NULL,0); return NULL; } if(WriteProcessMemory(GetCurrentProcess(),ppfnEntry,&pfnNew,sizeof(pfnNew),NULL) == 0){ MessageBox(NULL,L"WriteProcessMemory Err!",NULL,0); } if(VirtualProtect(memInfo.BaseAddress,memInfo.RegionSize,PAGE_READONLY,&dwOldProtect )==0){ MessageBox(NULL,L"VirtualProtect[2] is Err!",NULL,0); } return bak; } } //MessageBox(NULL,L"not found PIMAGE_THUNK_DATA",NULL,0); return NULL; } BOOL APIENTRY DllMain( HMODULE hModule, DWORD reason, LPVOID lpReserved ) { switch (reason){ case DLL_PROCESS_ATTACH: g_hInstance = hModule; if(bak_addr==NULL){ bak_addr = HookApi("objsys","user32.dll","GetCursorPos",(PROC)MyGetCursorPos); //bak_addr = HookApi(NULL,"user32.dll","GetCursorPos",(PROC)MyGetCursorPos); } break; case DLL_PROCESS_DETACH: //当 dll 卸载 时 需要恢复， 原 dll 功能地址 if(bak_addr!=NULL){ //HookApi(NULL,"user32.dll","GetCursorPos",bak_addr); HookApi("objsys","user32.dll","GetCursorPos",bak_addr); bak_addr = NULL; } break; } return TRUE; }