C# 优雅的实现ApiHook

全部源码下载：https://download.csdn.net/download/vblegend_2013/10680642

 通过继承NtAPIHook<泛型委托> 定义API ，并提供绕过Hook的源函数Origin委托

此模块支持 32位和64位

 

Hook处理类

using System;
using System.Runtime.InteropServices;

namespace NativeHook.Test
{
    public delegate Int32 MessageBoxW(IntPtr hWnd, [MarshalAs(UnmanagedType.LPWStr)] string lpText, 
                                              [MarshalAs(UnmanagedType.LPWStr)] string lpCaption, UInt32 uType);

    public class MessageBoxHook : NtAPIHook<MessageBoxW>
    {

        [DllHook("user32", EntryPoint = "MessageBoxW")]
        public Int32 MessageBox(IntPtr owner, string text, string caption, UInt32 options)
        {
            //拦截信息
            Console.Title = caption;
            Console.WriteLine(text);
            //调用源函数
            return Origin.Invoke(owner, text, caption, options);
        }
    }
}

创建Hook 及 Hook作用域

using System;
using System.Windows.Forms;
using System.Runtime.InteropServices;

namespace NativeHook.Test
{
    class Program
    {
        [STAThread]
        static void Main(string[] args)
        {
            using (var hook = new MessageBoxHook())
            {
                //绕过Hook直接调用源函数
                hook.Origin(IntPtr.Zero, "111", "222", 0);
                //调用Api 被Hook
                MessageBox.Show("Hello world", "666", MessageBoxButtons.YesNoCancel);
            }
            //Hook解除拦截不到
            MessageBox.Show("Hello world", "666", MessageBoxButtons.YesNoCancel);
        }
    }
}