hook api 例子（转）

hook api的一例子 C+/VC

[ 2008-7-30 22:33:00 | 发表者 : zihe ]

帮同学写了个hook api的例子程序,顺便post到这儿,免得将来到处找.

一个简单的console工程,vc6,vc7在win2k pro,server上调试通过.

#include <stdio.h>

#include <windows.h>

#include <dbghelp.h>

#pragma comment(lib,"dbghelp.lib")

#pragma comment(lib,"user32.lib")

typedef int (__stdcall *old_messagebox)( hwnd hwnd, lpctstr lptext, lpctstr lpcaption,uint utype );

old_messagebox g_procoldmessagebox = null;

int __stdcall hook_messagebox( hwnd hwnd, lpctstr lptext, lpctstr lpcaption,uint utype)

{

 printf("%s/t%d/r/n",__function__,__line__);

 if (null != g_procoldmessagebox)

  return g_procoldmessagebox(hwnd,lptext,"不好意思,hook到了!",utype); 

 else

  return messagebox(hwnd,lptext,lpcaption,utype); ;

}

int replace_iat(const char *pdllname,const char *papiname,bool breplace)

{

 handle hprocess = ::getmodulehandle (null);

 dword dwsize = 0;

 pimage_import_descriptor pimageimport = (pimage_import_descriptor)imagedirectoryentrytodata(hprocess,true,

  image_directory_entry_import,&dwsize);

 if (null == pimageimport)

  return 1;

 pimage_import_by_name pimageimportbyname = null;

 pimage_thunk_data  pimagethunkoriginal = null;

 pimage_thunk_data  pimagethunkreal  = null;

 while (pimageimport->name)

 {

  if (0 == strcmpi((char*)((pbyte)hprocess+pimageimport->name),pdllname))

  {

   break;

  }

  ++pimageimport;

 }

 if (! pimageimport->name)

  return 2;

 pimagethunkoriginal = (pimage_thunk_data)((pbyte)hprocess+pimageimport->originalfirstthunk  );

 pimagethunkreal = (pimage_thunk_data)((pbyte)hprocess+pimageimport->firstthunk   );

 while (pimagethunkoriginal->u1.function)

 {

  if ((pimagethunkoriginal->u1 .ordinal & image_ordinal_flag) != image_ordinal_flag)

  {

   pimageimportbyname = (pimage_import_by_name)((pbyte)hprocess+pimagethunkoriginal->u1 .addressofdata );

   if (0 == strcmpi(papiname,(char*)pimageimportbyname->name))

   {

    memory_basic_information mbi_thunk;

    virtualquery(pimagethunkreal, &mbi_thunk, sizeof(memory_basic_information)); 

    virtualprotect(mbi_thunk.baseaddress,mbi_thunk.regionsize, page_readwrite, &mbi_thunk.protect); 

    if (true == breplace)

    {

     g_procoldmessagebox =(old_messagebox) pimagethunkreal->u1.function; 

     pimagethunkreal->u1.function = (dword)hook_messagebox;

    }

    else

     pimagethunkreal->u1.function = (dword)g_procoldmessagebox;

    dword dwoldprotect; 

    virtualprotect(mbi_thunk.baseaddress, mbi_thunk.regionsize, mbi_thunk.protect, &dwoldprotect);

    break;

   }

  }

  ++pimagethunkoriginal;

  ++pimagethunkreal;

 }

 return 0;

}

int main()

{

 replace_iat("user32.dll","messageboxa",true);

 messagebox(null,"enumiat user32.dll messageboxa true;","",mb_ok);

 replace_iat("user32.dll","messageboxa",false);

 messagebox(null,"enumiat user32.dll messageboxa false;","",mb_ok);

 return getchar();

}