IAT hook

include <winternl.h>
#include "DialogMain.h"

typedef BOOL (WINAPI* PEEKMESSAGE)(LPMSG lpMsg,HWND hWnd,UINT wMsgFilterMin,UINT wMsgFilterMax,UINT wRemoveMsg);

PEEKMESSAGE FakePeekMessage=( PEEKMESSAGE)PeekMessage;
BOOL WINAPI MinePeekMessage(LPMSG lpMsg,HWND hWnd, UINT wMsgFilterMin,UINT wMsgFilterMax,UINT wRemoveMsg)
{
  AfxMessageBox(_T("你TM是不是调用我啦？"));
  return ((PEEKMESSAGE)FakePeekMessage)(lpMsg,hWnd,wMsgFilterMin,wMsgFilterMax,wRemoveMsg);
}

BOOL CDialogMain::ImportAddressTableHook(HMODULE ModuleAddress,LPCTSTR Library,LPCVOID TargetAddress,LPCVOID ReplaceAddress)
{
  IMAGE_DOS_HEADER* ImageDosHearderPointer=NULL;
  IMAGE_OPTIONAL_HEADER* ImageOptionalHeaderPointer=NULL;  
  IMAGE_IMPORT_DESCRIPTOR* ImageImportDescriptorPointer=NULL;
  IMAGE_THUNK_DATA* ImageThunkDataPointer=NULL;
  CString TargetName;
  DWORD Value=0;
  LPDWORD FunctionAddress=NULL;
  MEMORY_BASIC_INFORMATION InforMation;
  DWORD BeforeProtect=0;

  ImageDosHearderPointer=(IMAGE_DOS_HEADER*)ModuleAddress;
  ImageOptionalHeaderPointer=(IMAGE_OPTIONAL_HEADER*)((DWORD)ModuleAddress+ImageDosHearderPointer->e_lfanew+24);
  ImageImportDescriptorPointer=(IMAGE_IMPORT_DESCRIPTOR*)
                 ((DWORD)ModuleAddress+ImageOptionalHeaderPointer->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
  while(ImageImportDescriptorPointer->FirstThunk!=0)   
  {   
    TargetName=(LPCTSTR)((DWORD)ModuleAddress+ImageImportDescriptorPointer->Name);
    if(TargetName.Compare(Library)==0)
    {   
      Value=(DWORD)ModuleAddress+ImageImportDescriptorPointer->FirstThunk;
      break;
    }
    ImageImportDescriptorPointer++;   
  }  
  if (Value==0)
  {
    AfxMessageBox(_T("获取导入地址表失败!"));
    return FALSE;
  }
  else
  {
    ImageThunkDataPointer=(IMAGE_THUNK_DATA*)Value;
    while(ImageThunkDataPointer->u1.Function)   
    {   
      FunctionAddress=(LPDWORD)&(ImageThunkDataPointer->u1.Function);

      if(*FunctionAddress==(DWORD)TargetAddress)
      {   
        DebugInfo.Format(_T("%x"),*FunctionAddress);
        EditHeroBlood.SetWindowText(DebugInfo);
        VirtualQuery(FunctionAddress,&InforMation,sizeof(InforMation));   
        VirtualProtect(FunctionAddress, sizeof(DWORD),PAGE_READWRITE,&BeforeProtect);   
        if (::WriteProcessMemory((HANDLE)-1,FunctionAddress,&ReplaceAddress,sizeof(DWORD),NULL)==FALSE)
        {
          AfxMessageBox(_T("修改导入地址表失败!"));
          return FALSE;
        }
        else
        {
          VirtualProtect(FunctionAddress,sizeof(DWORD),BeforeProtect,0);   
          return TRUE;
        }
      }   
      ImageThunkDataPointer++;   
    }
  }
  return FALSE;
}