Mobile6.1 API Hook问题

 

void  HookOneAPI(LPCTSTR pszCalleeModuleName,PROC pfnOriginApiAddress,PROC pfnDummyFuncAddress,HMODULE hModCallerModule)
{
 RETAILMSG(1,(TEXT("--HookOneAPI------1----/n")));

 pDosHeader = (PIMAGE_DOS_HEADER)hModCallerModule;
 RETAILMSG(1,(TEXT("--HookOneAPI------1--1--/n")));

    pNTHeaders = (PIMAGE_NT_HEADERS)((BYTE *)hModCallerModule + pDosHeader->e_lfanew);
 RETAILMSG(1,(TEXT("--HookOneAPI------1--2--/n")));
    pOptHeader = (PIMAGE_OPTIONAL_HEADER)&(pNTHeaders->OptionalHeader);

 RETAILMSG(1,(TEXT("--HookOneAPI------1--3--/n")));
    pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((BYTE *)hModCallerModule + pOptHeader->DataDirectory[1].VirtualAddress);
 
 RETAILMSG(1,(TEXT("--HookOneAPI------2----/n")));

 while(pImportDescriptor->FirstThunk)
 {
  char * dllname = (char *)((BYTE *)hModCallerModule + pImportDescriptor->Name);

  pThunkData = (PIMAGE_THUNK_DATA)((BYTE *)hModCallerModule + pImportDescriptor->OriginalFirstThunk);

  RETAILMSG(1,(TEXT("--HookOneAPI------3----/n")));

  int no = 1;
  while(pThunkData->u1.Function)
  {
   char * funname = (char *)((BYTE *)hModCallerModule + (DWORD)pThunkData->u1.AddressOfData + 2);
   PDWORD lpAddr = (DWORD *)((BYTE *)hModCallerModule + (DWORD)pImportDescriptor->FirstThunk) +(no-1);
    
   //修改内存的部分
   if((*lpAddr) == (int)pfnOriginApiAddress)
   {
    RETAILMSG(1,(TEXT("--HookOneAPI------4----/n")));

    //修改内存页的属性
    DWORD dwOLD;
    MEMORY_BASIC_INFORMATION  mbi;
    VirtualQuery(lpAddr,&mbi,sizeof(mbi));
    VirtualProtect(lpAddr,sizeof(DWORD),PAGE_READWRITE,&dwOLD);
            
    WriteProcessMemory(GetCurrentProcess(),
      lpAddr, &pfnDummyFuncAddress, sizeof(pfnDummyFuncAddress), NULL);
    //恢复内存页的属性
    VirtualProtect(lpAddr,sizeof(DWORD),dwOLD,0);

    return;
   }
   //---------
   no++;
   pThunkData++;
  }

  pImportDescriptor++;
 }
}
DWORD GetProcessAddress(LPCTSTR pName)
{
 HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
 if (INVALID_HANDLE_VALUE == hSnapshot)
 {
  return 0;
 }
 PROCESSENTRY32 pe = { sizeof(pe) };
 BOOL fOk;
 for (fOk = Process32First(hSnapshot, &pe); fOk; fOk = Process32Next(hSnapshot, &pe))
 {
  if (0 == wcscmp(pe.szExeFile, pName))
  {
   CloseHandle(hSnapshot);
   return pe.th32MemoryBase;
  }
 }
 CloseHandle(hSnapshot);
 return 0;
}

BOOL InstallHook(BOOL IsHook)
{
 modeStatus = SetKMode(TRUE);
 dwPerm = SetProcPermissions(GetCurrentPermissions());
 
 DWORD currHandle = GetProcessAddress(TEXT("cmdcore.exe"));
 

 HookOneAPI(L"coredll.dll",GetProcAddress(GetModuleHandle(TEXT("coredll.dll")),L"DispatchMessageW"),(PROC)&H_DispatchMessageW,(HMODULE)currHandle/*GetModuleHandle(TEXT("console.dll"))*/);

 
 return TRUE;
}

 

 

现在代码执行到

    RETAILMSG(1,(TEXT("--HookOneAPI------1--1--/n")));

    pNTHeaders = (PIMAGE_NT_HEADERS)((BYTE *)hModCallerModule + pDosHeader->e_lfanew);

会出现异常。

 

我得到的hModCallerModule值是0x24000000，好像是地址访问受限，我通过SetKMode 和 SetProcPermissions 也没有任何改善。

 

希望大家能给些建议。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。