嘗試編寫的hook.dll C++鉤子技術

作用: 用來擷取


WM_PSD_ENVSTAMPRECT 這個得lparm值 來當作監控第三方的軟體應用

 監控第三方軟體的滑軌的位置數值  實測代碼已可用 !!


// hookps.cpp : Custom DLL's exported function application.
//
#include <windows.h>
#include "stdafx.h"
#include "hookps.h"
#include <stdlib.h>
//------------------------------------
#define WINAPI_stdcall
#define WM_PSD_ENVSTAMPRECT     (WM_USER+5)
#define WM_USER                  0x0400


//----------------------------------------
// Shared variable
 # pragma data_seg (".shared")
 HWND g_myhwnd=0;
 //HINSTANCE hmod=::LoadLibraryA("hookps.dll");
 
 // save the hook handle
//static UINT_PTR CALLBACK PaintHookProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam);
//int GetWindowTextRemote(HWND hwnd,LPSTR lpString);  
//int ReleaseHook();


# pragma data_seg ()
# pragma comment (linker, "/section:.shared,RWS")
HHOOK hThisHook1=0;
HHOOK hThisHook2=0,hThisHook3;



//----------------------------------------------------- 
// LRESULT CALLBACK MessageProc(int code,WPARAM wParam,LPARAM lParam);//


HMODULE base;
BOOL WINAPI DllMain(
  HMODULE hinstDLL,
  DWORD fdwReason,
  LPVOID lpvReserved
)
{
if(fdwReason==1)base=hinstDLL;
return 1;
}


LRESULT CALLBACK CallWndProc(
    int nCode,
    WPARAM wParam,
    PCWPSTRUCT lParam
)
{
	if(lParam->hwnd!=g_myhwnd)
	if(lParam->message==WM_PSD_ENVSTAMPRECT)
	{
		PostMessageW(g_myhwnd,0x405,(WPARAM)lParam->hwnd,lParam->lParam);
	}
	return CallNextHookEx(0,nCode,wParam,(LPARAM)lParam);
}


LRESULT CALLBACK GetMsgProc(
    int nCode,
    WPARAM wParam,
    PMSG lParam
)
{
	if(lParam->hwnd!=g_myhwnd)
	if(lParam->message==WM_PSD_ENVSTAMPRECT)
	{
		PostMessageW(g_myhwnd,0x405,(WPARAM)lParam->hwnd,lParam->lParam);
	}
	return CallNextHookEx(0,nCode,wParam,(LPARAM)lParam);
}


LRESULT CALLBACK SysMsgProc(
    int nCode,
    WPARAM wParam,
    PMSG lParam
)
{
	if(lParam->hwnd!=g_myhwnd)
	if(lParam->message==WM_PSD_ENVSTAMPRECT)
	{
		PostMessageW(g_myhwnd,0x405,(WPARAM)lParam->hwnd,lParam->lParam);
	}
	return CallNextHookEx(0,nCode,wParam,(LPARAM)lParam);
}


// Set the mount hook
void __stdcall SetHook(HWND myhwnd)
{
	g_myhwnd=myhwnd;
	hThisHook1=SetWindowsHookExW(WH_CALLWNDPROC,(HOOKPROC)CallWndProc,base,0);
	hThisHook2=SetWindowsHookExW(WH_GETMESSAGE,(HOOKPROC)GetMsgProc,base,0);
	hThisHook3=SetWindowsHookExW(WH_SYSMSGFILTER,(HOOKPROC)SysMsgProc,base,0);
};


void __stdcall ReleaseHook(void)                                                    //  <<<<<<Off the hook
{ 
UnhookWindowsHookEx(hThisHook1);
UnhookWindowsHookEx(hThisHook2);
UnhookWindowsHookEx(hThisHook3);
};


目前最好的EasyHook的完整Demo程序,包括了Hook.dll动态库和Inject.exe注入程序。 Hook.dll动态库封装了一套稳定的下钩子的机制,以后对函数下钩子,只需要填下数组表格就能实现了,极大的方便了今后的使用。 Inject.exe部分是用MFC写的界面程序,只需要在界面上输入进程ID就能正确的HOOK上相应的进程,操作起来非常的简便。 这个Demo的代码风格也非常的好,用VS2010成功稳定编译通过,非常值得下载使用。 部分代码片段摘录如下: //【Inject.exe注入程序的代码片段】 void CInjectHelperDlg::OnBnClickedButtonInjectDllProcessId() { ////////////////////////////////////////////////////////////////////////// //【得到进程ID值】 UINT nProcessID = 0; if (!GetProcessID(nProcessID)) { TRACE(_T("%s GetProcessID 失败"), __FUNCTION__); return; } ////////////////////////////////////////////////////////////////////////// //【得到DLL完整路径】 CString strPathDLL; if (!GetDllFilePath(strPathDLL)) { TRACE(_T("%s GetDllFilePath 失败"), __FUNCTION__); return; } ////////////////////////////////////////////////////////////////////////// //【注入DLL】 NTSTATUS ntStatus = RhInjectLibrary(nProcessID, 0, EASYHOOK_INJECT_DEFAULT, strPathDLL.GetBuffer(0), NULL, NULL, 0); if (!ShowStatusInfo(ntStatus)) { TRACE(_T("%s ShowStatusInfo 失败"), __FUNCTION__); return; } } //【Hook.dll动态库的代码片段】 extern "C" __declspec(dllexport) void __stdcall NativeInjectionEntryPoint(REMOTE_ENTRY_INFO* InRemoteInfo) { if (!DylibMain()) { TRACE(_T("%s DylibMain 失败"), __FUNCTION__); return; } } FUNCTIONOLDNEW_FRMOSYMBOL array_stFUNCTIONOLDNEW_FRMOSYMBOL[]= { {_T("kernel32"), "CreateFileW", (void*)CreateFileW_new}, {_T("kernel32"), "CreateFileA", (void*)CreateFileA_new}, {_T("kernel32"), "ReadFile", (void*)ReadFile_new} }; BOOL HookFunctionArrayBySymbol() { /////////////////////////////////////////////////////////////// int nPos = 0; do { /////////////////////////////// FUNCTIONOLDNEW_FRMOSYMBOL* stFunctionOldNew = &g_stFUNCTIONOLDNEW_FRMOSYMBOL[nPos]; if (NULL == stFunctionOldNew->strModulePath) { break; } /////////////////////////////// if (!HookFunctionBySymbol(stFunctionOldNew->strModulePath, stFunctionOldNew->strNameFunction, stFunctionOldNew->pFunction_New)) { TRACE(_T("%s HookFunctionBySymbol 失败"), __FUNCTION__); return FALSE; } } while(++nPos); /////////////////////////////////////////////////////////////// return TRUE; } HANDLE WINAPI CreateFileW_new( PWCHAR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile ) { TRACE(_T("CreateFileW_new. lpFileName = %s"), lpFileName); return CreateFileW( lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile); }
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值