hook api (push xxxx/retn)

最新推荐文章于 2022-04-11 15:44:10 发布

fanpeii

最新推荐文章于 2022-04-11 15:44:10 发布

阅读量787

点赞数

分类专栏： windows api 学习心得文章标签： api hook null dll byte user

本文链接：https://blog.csdn.net/fanpeii/article/details/6171718

版权

windows api 学习心得专栏收录该内容

20 篇文章 0 订阅

订阅专栏

#include<windows.h>
#include"LDasm.c"

int   (_stdcall * pMessageBox)(HWND hWnd,LPCTSTR lpText,LPCTSTR lpCaption,UINT uType);

int _stdcall myMessageBox(HWND hWnd,LPCTSTR lpText,LPCTSTR lpCaption,UINT uType)
{
    lpText="hello";
    return ( *pMessageBox)(hWnd,lpText,lpCaption,uType);
}

bool hookapi_p(
            LPCTSTR dll,//dll的名称
            LPCSTR api,//API的名称
            DWORD *lpfunc,//自己函数的地址
            LPVOID *NextHook//NextHook的地址
            )
{
    FARPROC handle;
    PBYTE bytec;
    PDWORD dwordc;
    int pSize;
    unsigned long oldpoint;

    handle=GetProcAddress(LoadLibrary(dll),api);
    if(!handle) return 0;
    if (*((PUCHAR)handle)==0xe8) return 0;
    pSize = SizeOfHook_push(handle);

    if (VirtualProtect(handle,pSize,PAGE_EXECUTE_READWRITE,&oldpoint))//开启可写属性
    {
        *NextHook = VirtualAlloc(NULL,0x1000, MEM_COMMIT,PAGE_EXECUTE_READWRITE);    //'申请内存空间
        //将原函数前pSize个字节复制到NextHook中
        CopyMemory ((PVOID)*NextHook,handle,pSize);                               //读取n字节保存

        //再已复制的字节后添加跳转至原函数+pSize
        bytec=(PBYTE)(*NextHook);
        *(bytec+pSize)=0xe9;
        dwordc=(PDWORD)((DWORD)*NextHook+pSize+1);
        *(dwordc)=(DWORD)handle-(DWORD)*NextHook-5;

        // '保存被Hook API函数的地址
        dwordc=(PDWORD)((DWORD)*NextHook+pSize+5);
        *(dwordc)=(DWORD)handle;

        //将原函数修改为跳转到指定的函数
        bytec=(PBYTE)(handle);
        *(bytec)=0x68;
        dwordc=(PDWORD)((DWORD)handle+1);
        *(dwordc)=(DWORD)lpfunc;
        *(bytec+5)=0xc3;

        FlushInstructionCache(GetCurrentProcess(), handle, pSize);                 //'确保执行更改
        VirtualProtect(handle, pSize, oldpoint, &oldpoint);                    // '恢复原来的属性
    }
    else
        return 0;
    return 1;
}

bool unhookapi_p(LPVOID *NextHook)//NextHook的地址
{
    BYTE bytec;
    LPVOID lOldAddrs;
    int pSize;
    unsigned long oldpoint;


    pSize = SizeOfHook_push(*NextHook);
    if (NextHook)
    {
        bytec=(BYTE)*((PBYTE)*NextHook+pSize);
        if (bytec==0xe9)
        {
            lOldAddrs=(LPVOID)*(PDWORD)((DWORD)*NextHook+pSize+5);
            VirtualProtect(lOldAddrs, pSize, PAGE_EXECUTE_READWRITE, &oldpoint);         // '修改内存属性页为可写
            CopyMemory ((PVOID)lOldAddrs,*NextHook,pSize);
            FlushInstructionCache(GetCurrentProcess(), lOldAddrs, pSize);                 //'确保执行更改
            VirtualProtect(*NextHook, pSize, oldpoint, &oldpoint);                    // '恢复原来的属性
            if(VirtualFree(*NextHook, NULL, MEM_RELEASE))                  // '释放内存空间
               *NextHook = NULL;                                                      // '把自己函数地址设为NULL
        }
        else
            return 0;
    }
    else
        return 0;
    return 1;
}

void main()
{
    MessageBoxA(NULL,"1","2",MB_OK);
    hookapi_p("user32.dll","MessageBoxA",(PDWORD)myMessageBox,(LPVOID*)&pMessageBox);
    MessageBoxA(NULL,"4","3",MB_OK);
    unhookapi_p((LPVOID*)&pMessageBox);
    MessageBoxA(NULL,"4","3",MB_OK);
}

/**********************************
连城制作注意版权哦。
QQ：173661967
**********************************/