我写的传奇世界HOOK代码，有错误！(收藏)

请问各们大虾！这段程序究竟错在哪儿了，窗口出来了，截获两个API函数时出错。

#include <winsock2.h>
#include <windows.h>
#include <imagehlp.h>
#include "Indll.h"
HHOOK hGamehook;
HMODULE h_Gamemodule=GetModuleHandle("woool.dat"),
h_Dllmodule=GetModuleHandle("WS2_32.DLL"),h_themodule;
HWND hDlgwnd=NULL,hGamewnd=FindWindow(NULL,"传奇世界 v1.7.5.0 ");
struct funaddrinfo
{
DWORD address;
DWORD saddr;
DWORD naddr;
};
struct funaddrinfo WSASendinfo,WSARecvinfo;
LRESULT CALLBACK ApiHookProc(int nCode,WPARAM wParam,LPARAM lParam);
BOOL CALLBACK DlgWndProc(HWND hwnd,UINT message,WPARAM wParam,LPARAM lParam);
bool Apihook();
bool Ismoduleload();
int (*psend)(SOCKET s,LPWSABUF lpBuffers,DWORD dwBufferCount,LPDWORD lpNumberOfBytesSent,DWORD dwFlags,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine);
int (*precv)(SOCKET s,LPWSABUF lpBuffers,DWORD dwBufferCount,LPDWORD lpNumberOfBytesRecvd,LPDWORD lpFlags,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine);
int M_send(SOCKET s,LPWSABUF lpBuffers,DWORD dwBufferCount,LPDWORD lpNumberOfBytesSent,DWORD dwFlags,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine);
int M_recv(SOCKET s,LPWSABUF lpBuffers,DWORD dwBufferCount,LPDWORD lpNumberOfbytesRecvd,LPDWORD lpFlags,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine);
BOOL WINAPI DllMain(HINSTANCE hInstance,DWORD dwReason,LPVOID NotUsed)
{
switch(dwReason)
{
case DLL_PROCESS_ATTACH:
h_themodule=(HINSTANCE)hInstance;
break;
case DLL_PROCESS_DETACH:
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
break;
}
return TRUE;
}
extern "C" __declspec(dllexport) void InDll(BOOL IsHook)
{
if(IsHook==FALSE)
{
UnhookWindowsHookEx(hGamehook);
return;
}
DWORD dwThreadId;
dwThreadId=GetWindowThreadProcessId(hGamewnd,NULL);
hGamehook=SetWindowsHookEx(WH_KEYBOARD,(HOOKPROC)ApiHookProc,h_themodule,dwThreadId);
}
bool Ismoduleload()
{
if(h_Gamemodule==NULL)
{
MessageBox(NULL,"woool.dat not be load","Message",MB_OK);
return false;
}
if(h_Dllmodule==NULL)
{
MessageBox(NULL,"ws2_32.dll not be load","Message",MB_OK);
return false;
}
return true;
}
LRESULT CALLBACK ApiHookProc(int nCode,WPARAM wParam,LPARAM lParam)
{
switch(nCode)
{
case HC_ACTION:
switch(wParam)
{
case VK_HOME:
BOOL bKeyUp=lParam&(1<<31);
if(bKeyUp)
{
if(hDlgwnd==NULL)
{
hDlgwnd=CreateDialog(h_themodule,MAKEINTRESOURCE(IDD_DIALOG1),hGamewnd,(DLGPROC)DlgWndProc);
break;
}
ShowWindow(hDlgwnd,IsWindowVisible(hDlgwnd)?SW_HIDE:SW_SHOW);
}
}
}
return CallNextHookEx(hGamehook,nCode,wParam,lParam);
}
BOOL CALLBACK DlgWndProc(HWND hwnd,UINT message,WPARAM wParam,LPARAM lParam)
{
switch(message)
{
case WM_COMMAND:
switch(LOWORD(wParam))
{
case IDOK:
if(Apihook()==false)
{
MessageBox(NULL,"Hook faild","Message",MB_OK);
}
break;
}
break;
case IDCANCEL:
break;
}
return FALSE;
}
bool Apihook()
{
ULONG ulSize;
unsigned char nFlags=0;
PROC sfunsend,sfunrecv,ufunsend,ufunrecv;
sfunsend=(PROC)GetProcAddress(h_Dllmodule,"WSASend");
sfunrecv=(PROC)GetProcAddress(h_Dllmodule,"WSARecv");
ufunsend=(PROC)GetProcAddress(h_themodule,"M_send");
ufunrecv=(PROC)GetProcAddress(h_themodule,"M_recv");
PIMAGE_IMPORT_DESCRIPTOR pImportDesc=(PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(h_Gamemodule,TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT,&ulSize);
if(pImportDesc==NULL)
{
MessageBox(NULL,"Not found the Import","Message",MB_OK);
return false;
}
for(;pImportDesc->Name;pImportDesc++)
{
PSTR pszModName=(PSTR)((PBYTE)h_Gamemodule+pImportDesc->Name);
if(lstrcmpi(pszModName,"WS2_32.DLL")==0)
break;
}
if(pImportDesc->Name==0)
{
MessageBox(NULL,"Not found the Dll","Message",MB_OK);
return false;
}
PIMAGE_THUNK_DATA pThunk=(PIMAGE_THUNK_DATA)((PBYTE)h_Gamemodule+pImportDesc->FirstThunk);
for(;pThunk->u1.Function;pThunk++)
{
PROC* ppfn=(PROC*)&pThunk->u1.Function;
if(*ppfn==sfunsend)
nFlags=1;
if(*ppfn==sfunrecv)
nFlags=2;
switch(nFlags)
{
MEMORY_BASIC_INFORMATION membuffer;
DWORD dwOldProtect;
case 1:
WSASendinfo.address=(DWORD)ppfn;
VirtualQuery((PROC*)(ppfn),&membuffer,sizeof(membuffer));
VirtualProtect((PROC*)(ppfn),membuffer.RegionSize,PAGE_READWRITE,&membuffer.Protect);
WSASendinfo.saddr=(DWORD)*ppfn;
*ppfn=ufunsend;
WSASendinfo.naddr=(DWORD)*ppfn;
VirtualProtect(membuffer.BaseAddress,membuffer.RegionSize,membuffer.Protect,&dwOldProtect);
nFlags=3;
break;
case 2:
WSARecvinfo.address=(DWORD)ppfn;
VirtualQuery((PROC*)(ppfn),&membuffer,sizeof(membuffer));
VirtualProtect((PROC*)(ppfn),membuffer.RegionSize,PAGE_READWRITE,&membuffer.Protect);
WSARecvinfo.saddr=(DWORD)*ppfn;
*ppfn=ufunrecv;
WSARecvinfo.naddr=(DWORD)*ppfn;
VirtualProtect(membuffer.BaseAddress,membuffer.RegionSize,membuffer.Protect,&dwOldProtect);
nFlags=4;
break;
}
}
return true;
}
int M_send(SOCKET s,LPWSABUF lpBuffers,DWORD dwBufferCount,LPDWORD lpNumberOfBytesSent,DWORD dwFlags,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
{
MEMORY_BASIC_INFORMATION membuffer;
DWORD dwOldProtect;
PROC* lpsend;
lpsend=(PROC*)WSASendinfo.address;
HWND hlistwnd=GetDlgItem(hDlgwnd,IDC_LIST1);
int rvat;
VirtualQuery(lpsend,&membuffer,sizeof(membuffer));
VirtualProtect(membuffer.BaseAddress,membuffer.RegionSize,PAGE_READWRITE,&membuffer.Protect);
*lpsend=(PROC)WSASendinfo.saddr;
rvat=WSASend(s,lpBuffers,dwBufferCount,lpNumberOfBytesSent,dwFlags,lpOverlapped,lpCompletionRoutine);
*lpsend=(PROC)WSASendinfo.naddr;
VirtualProtect(membuffer.BaseAddress,membuffer.RegionSize,membuffer.Protect,&dwOldProtect);
SendMessage(hlistwnd,LB_ADDSTRING,0,(LPARAM)lpBuffers->buf);
return rvat;
}
int M_recv(SOCKET s,LPWSABUF lpBuffers,DWORD dwBufferCount,LPDWORD lpNumberOfBytesRecvd,LPDWORD lpFlags,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
{
HWND hlistwnd=GetDlgItem(hDlgwnd,IDC_LIST1);
int rvat;
MEMORY_BASIC_INFORMATION membuffer;
DWORD dwOldProtect;
PROC *lprecv=(PROC*)WSARecvinfo.address;
VirtualQuery(lprecv,&membuffer,sizeof(membuffer));
VirtualProtect(membuffer.BaseAddress,membuffer.RegionSize,PAGE_READWRITE,&membuffer.Protect);
*lprecv=(PROC)WSARecvinfo.saddr;
rvat=WSARecv(s,lpBuffers,dwBufferCount,lpNumberOfBytesRecvd,lpFlags,lpOverlapped,lpCompletionRoutine);
*lprecv=(PROC)WSARecvinfo.naddr;
VirtualProtect(membuffer.BaseAddress,membuffer.RegionSize,membuffer.Protect,&dwOldProtect);
SendMessage(hlistwnd,LB_ADDSTRING,0,(LPARAM)lpBuffers->buf);
return rvat;
}

Re:我写的传奇世界HOOK代码，有错误！ 从楼主的代码看来楼主没有搞明白iat api hook的原理!