hook api的一例子 C+/VC

 hook api的一例子 C+/VC[ 2008-7-30 22:33:00 | 发表者 : zihe ]
帮同学写了个hook api的例子程序,顺便post到这儿,免得将来到处找.一个简单的console工程,vc6,vc7在win2k pro,server上调试通过.#include <stdio.h>#include <windows.h>#include <dbghelp.h>#pragma comment(lib,"dbghelp.lib")#pragma comment(lib,"user32.lib")typedef int (__stdcall *old_messagebox)( hwnd hwnd, lpctstr lptext, lpctstr lpcaption,uint utype );old_messagebox g_procoldmessagebox = null;int __stdcall hook_messagebox( hwnd hwnd, lpctstr lptext, lpctstr lpcaption,uint utype){ printf("%s/t%d/r/n",__function__,__line__); if (null != g_procoldmessagebox)  return g_procoldmessagebox(hwnd,lptext,"不好意思,hook到了!",utype);  else  return messagebox(hwnd,lptext,lpcaption,utype); ;}
int replace_iat(const char *pdllname,const char *papiname,bool breplace){ handle hprocess = ::getmodulehandle (null); dword dwsize = 0; pimage_import_descriptor pimageimport = (pimage_import_descriptor)imagedirectoryentrytodata(hprocess,true,  image_directory_entry_import,&dwsize); if (null == pimageimport)  return 1; pimage_import_by_name pimageimportbyname = null; pimage_thunk_data  pimagethunkoriginal = null; pimage_thunk_data  pimagethunkreal  = null; while (pimageimport->name) {  if (0 == strcmpi((char*)((pbyte)hprocess+pimageimport->name),pdllname))  {   break;  }  ++pimageimport; } if (! pimageimport->name)  return 2; pimagethunkoriginal = (pimage_thunk_data)((pbyte)hprocess+pimageimport->originalfirstthunk  ); pimagethunkreal = (pimage_thunk_data)((pbyte)hprocess+pimageimport->firstthunk   ); while (pimagethunkoriginal->u1.function) {  if ((pimagethunkoriginal->u1 .ordinal & image_ordinal_flag) != image_ordinal_flag)  {   pimageimportbyname = (pimage_import_by_name)((pbyte)hprocess+pimagethunkoriginal->u1 .addressofdata );   if (0 == strcmpi(papiname,(char*)pimageimportbyname->name))   {    memory_basic_information mbi_thunk;    virtualquery(pimagethunkreal, &mbi_thunk, sizeof(memory_basic_information));     virtualprotect(mbi_thunk.baseaddress,mbi_thunk.regionsize, page_readwrite, &mbi_thunk.protect);     if (true == breplace)    {     g_procoldmessagebox =(old_messagebox) pimagethunkreal->u1.function;      pimagethunkreal->u1.function = (dword)hook_messagebox;    }    else     pimagethunkreal->u1.function = (dword)g_procoldmessagebox;    dword dwoldprotect;     virtualprotect(mbi_thunk.baseaddress, mbi_thunk.regionsize, mbi_thunk.protect, &dwoldprotect);    break;   }  }  ++pimagethunkoriginal;  ++pimagethunkreal; } return 0;}int main(){ replace_iat("user32.dll","messageboxa",true); messagebox(null,"enumiat user32.dll messageboxa true;","",mb_ok); replace_iat("user32.dll","messageboxa",false); messagebox(null,"enumiat user32.dll messageboxa false;","",mb_ok); return getchar();}