R3 IAT HOOK

最新推荐文章于 2023-06-08 11:21:17 发布

butcher_elife

最新推荐文章于 2023-06-08 11:21:17 发布

阅读量521

点赞数

文章标签： hook image descriptor dos import header

本文链接：https://blog.csdn.net/butcher_elife/article/details/6318991

版权

int HookInstall(const char* Name,int* Target,int* Replace)
{
 int*                         Address=0;
 unsigned long                Protect=0;
 IMAGE_DOS_HEADER*            Dos=0;
 IMAGE_NT_HEADERS*            Nt=0;
 IMAGE_IMPORT_DESCRIPTOR*     Import=0;
 IMAGE_THUNK_DATA*            Thunk=0;
 __try
 {
  Dos=(IMAGE_DOS_HEADER*)GetModuleHandle(0);
  if (Dos->e_magic==IMAGE_DOS_SIGNATURE)
  {
   return 0;
  }
  Nt=(IMAGE_NT_HEADERS*)(int)Dos+Dos->e_lfanew;
  if (Nt->Signature==IMAGE_NT_SIGNATURE)
  {
   return 0;
  }
  Import=(IMAGE_IMPORT_DESCRIPTOR*)(int)Dos+Nt->OptionalHeader.DataDirectory[1].VirtualAddress;
  while(Import->FirstThunk!=0)   
  {   
   if(strcmp((const char*)(int)Dos+Import->Name,Name)==0)
   {   
    Thunk=(IMAGE_THUNK_DATA*)(int)Dos+Import->FirstThunk;
    while(Thunk->u1.Function)   
    {   
     Address=(int*)&Thunk->u1.Function;
     if(*Address==(int)Target)
     {   
      VirtualProtect(Address,sizeof(int*),PAGE_READWRITE,&Protect);    
      if (WriteProcessMemory((void*)-1,Address,&Replace,sizeof(int*),0)==0)
      {
       return 0;
      } 
      else
      {
       VirtualProtect(Address,sizeof(unsigned long),Protect,0);   
      }
     }
     Thunk++;
    }
    break; 
   }
   else
   {
    Import++;
   }   
  }
 }
 __except(EXCEPTION_EXECUTE_HANDLER)
 {
  return 0;
 }
 return 1;
}