比Detours更给力的Hook库

转载 2012年05月24日 18:02:17
比Detours更给力的Hook库 2011-12-13 10:39

一个开源的HOOK库,比Detours更加给力

Detours vs. Mhook


Detours is available for free with a noncommercial license but it only supports the x86 platform. Detours can also be licensed for commercial use which also gives you full x64 support, but you only get to see the licensing conditions after signing an NDA.

Mhook is freely distributed under an MIT license with support for x86 and x64.

Detours shies away from officially supporting the attachment of hooks to a running application. Of course, you are free to do it - but if you end up causing a random crash here or there, you can only blame yourself.

Mhook was meant to be able to set and remove hooks in running applications – after all, that’s what you need it for in the real world. It does its best to avoid overwriting code that might be under execution by another thread.

Detours supports transactional hooking and unhooking; that is, setting a bunch of hooks at the same time with an all-or-nothing approach. Hooks will only be set if all of them can be set, otherwise the library will roll back any changes made. Mhook does not do this.

Detours has a built-in x86 (and, when paid for, x64) disassembler so it can automatically hook an API. This is the fundamental difference between Detours and Mhook, and probably the only one that really needs improvement: Mhook has no disassembler so the user must first, by hand, examnine the first few bytes of the target API and make the resulting information available to Mhook. This also means that Mhook will not function on an OS where the disassembly of the target function’s first few bytes is different from what has been anticipated. It is possible to give Mhook information on several possible disassemblies at once, thereby supporting multiple operating systems, but this is a bit inconvenient. On the other hand, the lack of a disassembler allows the library to remain very lightweight.

Finally, Mhook is pretty wasteful when it comes to allocating memory for the trampolines it uses. Detours allocates blocks of memory as needed, and uses the resulting data area to store as many trampolines within as will fit. Mhook, on the other hand, uses one call to VirtualAlloc per hook being set. Every hook needs less than 100 bytes of storage so this is very wasteful, since VirtualAlloc ends up grabbing 64K from the process' virtual address space every time Mhook calls it. (Actual allocated memory will be a single page which is also quite wasteful.) In the end though, this probably does not really matter, unless you are setting a very large number of hooks in an application. Also, this is very easy to fix.

With that out of the way, if you’re still here, let’s delve into it.

传送门:http://codefromthe70s.org/mhook22.aspx

基于Detours劫持360启动

一.首先需要下载detours(百度或者google),这里我们下载的DetoursExpress30.msi 二.安装detours 编译原代码 三.在VS2013 中找到Visual Stud...
  • huangshanchun
  • huangshanchun
  • 2015年04月02日 15:06
  • 1249

Detours 库使用(一)

Detours是微软开发的一个函数库,可用于捕获系统API。 Detours库的编译方法:http://blog.csdn.net/hewei0241/article/details/3832689...
  • wzf906819823
  • wzf906819823
  • 2015年08月09日 15:11
  • 784

下载Detours源代码、编译Detours Express Lib库(32位静态库,版本3.0)

下载以及编译Detours Lib库(32位静态库)。
  • faithzzf
  • faithzzf
  • 2016年12月06日 16:46
  • 1253

windows下的API拦截---利用detours库操作

API拦截技术是一种比较常见的技术,对某个软件使用的系统API进行拦截,可以改变软件的行为,从而达到自己的目的。关于拦截技术的原理,Jeffy在《Windows核心编程》里面介绍的非常详尽,就是通过P...
  • yongshi6
  • yongshi6
  • 2016年01月29日 14:51
  • 1801

库力索法半导体C++岗 笔试题

库力索法半导体C++岗笔试题1.题目#includechar * GetMemory(void) { char p[] = "hello world"; return p; }int ...
  • snowball_wang
  • snowball_wang
  • 2017年05月08日 17:08
  • 307

图解Detour安装及简单使用实例(Win7+VC6)

相关下载: http://pan.baidu.com/s/1o7OEMc6 detour6.rar是本文工程 DetoursExpress30是微软下载的detour安装文件 de...
  • bcbobo21cn
  • bcbobo21cn
  • 2016年05月06日 14:18
  • 2109

Hook DirectX 在War3 魔兽争霸界面写屏

由于经常玩Dota,11平台出来以后,发现War3界面上有一行字,“游戏正在进入....”。就想到了它的实现方式,HOOKAPI。《Windows核心编程》中有关于hookapi的描述, 以前都是——...
  • duyanbin68
  • duyanbin68
  • 2015年06月28日 17:55
  • 1702

关于detours的用法

1.从http://research.microsoft.com/sn/detours下载detour professional 3.0并且安装,记住你的安装目录。 2.生成detour.l...
  • ljiaw6969912
  • ljiaw6969912
  • 2015年05月30日 19:05
  • 1458

APP快速开发:用这些工具更给力

叮当 无需编程、无需设计、无需开发、无需外包,任何人都可以通过叮当免费创意生成属于自己的原生 App。 使用“叮当”制作一款普通应用只需要 2 天,花费为 0 元,App 无论是流畅度、美...
  • wang740209668
  • wang740209668
  • 2015年11月10日 09:00
  • 247

detours使用:detours3.0文档翻译

来自:http://blog.csdn.net/buck84/article/details/8289991 目录(?)[-] 拦截二进制函数使用DetoursPayloa...
  • xrain_zh
  • xrain_zh
  • 2015年04月07日 11:49
  • 718
内容举报
返回顶部
收藏助手
不良信息举报
您举报文章:比Detours更给力的Hook库
举报原因:
原因补充:

(最多只允许输入30个字)