Hook API的实现(pe)

为了截获API调用，只要用自定义函数的地址覆盖掉导入表中真实的API函数地址即可

导入表属于PE的知识

下面是挂钩MessageBoxA的例子，这个例子用自定义的函数MyMessgeBoxA取代API函数中的MessageBoxA,使得主模块对MessageBoxA的调用变成对自定义函数MyMessageBoxA的调用！

下面是代码：

CWinApp theApp; bool SetHook(HMODULE hMod); typedef int (WINAPI *PFNMESSAGEBOX)(HWND, LPCSTR, LPCSTR, UINT uType); PROC g_orgProc = (PROC)GetProcAddress(LoadLibrary("user32.dll"), "MessageBoxA"); using namespace std; int _tmain(int argc, TCHAR* argv[], TCHAR* envp[]) { int nRetCode = 0; // initialize MFC and print and error on failure if (!AfxWinInit(::GetModuleHandle(NULL), NULL, ::GetCommandLine(), 0)) { // TODO: change error code to suit your needs cerr << _T("Fatal Error: MFC initialization failed") << endl; nRetCode = 1; } else { // TODO: code your application's behavior here. CString strHello; strHello.LoadString(IDS_HELLO); cout << (LPCTSTR)strHello << endl; } ::MessageBox(NULL, "原函数", "09HookDemo", 0); SetHook(::GetModuleHandle(NULL)); ::MessageBox(NULL, "原函数", "09HookDemo", 0); return nRetCode; } int WINAPI MyMessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType) { return ((PFNMESSAGEBOX)g_orgProc)(hWnd, "新函数", "09HookDemo", 0); } bool SetHook(HMODULE hMod) { IMAGE_DOS_HEADER *pDosHeader = (IMAGE_DOS_HEADER *)hMod; IMAGE_OPTIONAL_HEADER *pOptHeader = (IMAGE_OPTIONAL_HEADER *)( (BYTE *)hMod + pDosHeader->e_lfanew + 24 ); IMAGE_IMPORT_DESCRIPTOR *pImportDesc = (IMAGE_IMPORT_DESCRIPTOR *)( (BYTE *)hMod + pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress); while(pImportDesc->FirstThunk) { char *pszDllName = (char *) ( (BYTE *)hMod + pImportDesc->Name); if(_stricmp(pszDllName, "user32.dll") == 0 ) { break; } pImportDesc++; } if(pImportDesc->FirstThunk) { IMAGE_THUNK_DATA *pThunk = (IMAGE_THUNK_DATA *)( (BYTE *)hMod + pImportDesc->FirstThunk); while(pThunk->u1.Function) { DWORD *lpAddr = (DWORD *)&pThunk->u1.Function; if(*lpAddr == (DWORD)g_orgProc) { DWORD *lpNewProc = (DWORD *)MyMessageBoxA; DWORD dwOldProtect; MEMORY_BASIC_INFORMATION mbi; VirtualQuery(lpAddr, &mbi, sizeof(mbi)); ::VirtualProtect(lpAddr, sizeof(DWORD), PAGE_READWRITE, &dwOldProtect); ::WriteProcessMemory(GetCurrentProcess(), lpAddr, &lpNewProc, sizeof(lpNewProc), NULL); //*lpAddr = (DWORD)lpNewProc; ::VirtualProtect(lpAddr, sizeof(DWORD), dwOldProtect, 0); return TRUE; } pThunk++; } } return false; }