Hook Wav Out, Dump 原始的音频文件．

某音频文件经过优化编码，发现解码以后是通过Wav Out API播放的．不具体研究他是如何解密的，直接Hook Wav 播放的API得到原始数据：

 

#include <mmsystem.h>
#pragma comment( lib, "winmm.lib" )

数据头的格式：

extern "C"  __declspec(dllexport) MMRESULT WINAPI MyWaveOutOpen( LPHWAVEOUT phwo, UINT uDeviceID, LPCWAVEFORMATEX pwfx, DWORD_PTR dwCallback, DWORD_PTR dwInstance, DWORD fdwOpen)
	{
		FILE *fp = fopen("test.dump.log","a+");
		if(fp)
		{
			fprintf(fp,"waveOutOpen\n");
			fprintf(fp,"pwfx->cbSize:%d\n",pwfx->cbSize);
			fprintf(fp,"pwfx->nAvgBytesPerSec:%d\n",pwfx->nAvgBytesPerSec);
			fprintf(fp,"pwfx->nBlockAlign:%d\n",pwfx->nBlockAlign);
			fprintf(fp,"pwfx->nChannels:%d\n",pwfx->nChannels);
			fprintf(fp,"pwfx->nSamplesPerSec:%d\n",pwfx->nSamplesPerSec);
			fprintf(fp,"pwfx->wBitsPerSample:%d\n",pwfx->wBitsPerSample); 

			fprintf(fp,"pwfx->wFormatTag:%d\n",pwfx->wFormatTag); 

			fclose(fp);
		}
		return waveOutOpen(phwo,uDeviceID,pwfx,dwCallback,dwInstance,fdwOpen);

	}

原始数据：

extern "C" __declspec(dllexport)  MMRESULT MyWaveOutWrite(HWAVEOUT hwo, LPWAVEHDR pwh, UINT cbwh )
	{

		FILE *fp = fopen("test.dump.log","a+");
		if(fp)
		{
			fprintf(fp,"BufferLength:%d,Flags:%d-- cbwh:%d \n",pwh->dwBufferLength,pwh->dwFlags, cbwh);
			fclose(fp);
		}

		FILE *fpEx;
		fpEx = fopen("test.dump","ab+");
		if(fpEx)
		{
			fseek(fpEx,0,SEEK_END);
			fwrite(pwh->lpData,1,pwh->dwBufferLength,fpEx);
			fclose(fpEx);
		}


		//return MMSYSERR_NOERROR; //
		return waveOutWrite(hwo,pwh,cbwh);

		
	}