Dll导出表Hook

#include "stdafx.h"
#include <windows.h>
#include <assert.h> 
#pragma comment(lib,"user32.lib")

typedef int (*detour_MessageBoxA)(HWND hWnd,LPCSTR,LPCSTR,UINT);
detour_MessageBoxA msg;
char origInstr[8] = {0};
char newInstr[8] = {"\xe9\x00\x00\x00\x00"};

int _tmain(int argc, _TCHAR* argv[])
{
	DWORD tmp;
	DWORD curr;
	char str[] = {""};
	char* funcName = NULL;
	HMODULE hMod = LoadLibrary("user32.dll");
	char* dllBase = (char*)hMod;
	IMAGE_DOS_HEADER *pDosHeader = (IMAGE_DOS_HEADER*)dllBase;    
    IMAGE_OPTIONAL_HEADER *pOptHeader = (IMAGE_OPTIONAL_HEADER*)((BYTE*)dllBase +  pDosHeader->e_lfanew + 24);  
    IMAGE_EXPORT_DIRECTORY *pExport = (IMAGE_EXPORT_DIRECTORY*)((BYTE*)dllBase + pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
	char* dllname = dllBase+pExport->Name;
	//函数名数组RVA，其数组元素为函数名的RVA
	DWORD* funcNameRvaTab = (DWORD*)(dllBase+pExport->AddressOfNames);
	//函数在dllBase+pExport->AddressOfFunctions数组中的索引值
	WORD* funcOrdinalTab = (WORD*)(dllBase+pExport->AddressOfNameOrdinals);
	DWORD* exportFuncAddrTab = (DWORD*)(dllBase+pExport->AddressOfFunctions);
	DWORD NumberOfNames = pExport->NumberOfNames;
	DWORD idx;
	DWORD oldProct;
	for(idx=0;idx<NumberOfNames;idx++)
	{
		funcName = (char*)(dllBase+funcNameRvaTab[idx]);
		if(strcmp((const char*)funcName,"MessageBoxA")==0)
		{
			DWORD idxInFuncAddrArry = funcOrdinalTab[idx];
			//获得函数在dll中的入口地址
			//exportFuncAddrTab[idxInFuncAddrArry]中存放的RVA了
			msg = (detour_MessageBoxA)(dllBase + exportFuncAddrTab[idxInFuncAddrArry]);
#if 0
			//能成功调用msgBox,但过不了checkEsp 设置调用约定_cdecl->stdcall
			(msg)(NULL,"","",MB_OK);
#endif			
			assert(VirtualProtect(msg,8,PAGE_EXECUTE_READWRITE,&oldProct)!=0);
			//save
			ReadProcessMemory(GetCurrentProcess(),msg,origInstr,8,&tmp);
			__asm
			{
				mov eax,Lab1;
				mov curr,eax;
			}
			//把函数入口处的指令替换为相对跳转指令，跳转的目标为Lab1
			//diff的计算可以搜索网上jmp跳转计算
			DWORD diff = (DWORD)curr-(DWORD)msg-5;
			memcpy(newInstr+1,(char*)&diff,sizeof(DWORD));

			WriteProcessMemory(GetCurrentProcess(),msg,newInstr,5,&tmp);
			(msg)(NULL,"","",MB_OK);
		}
	}

	while(1)
	{
		Sleep(1);
	}

	//这段代码本应该写成函数形式 但因为要用裸函数（否则函数开始就push ebp了）
	//所以直接改成代码片了
Lab1:
	static int cnt=0;
	
	cnt++;
	WriteProcessMemory(GetCurrentProcess(),msg,origInstr,8,&tmp);
	__asm
	{
		mov eax,Lab2;
		mov curr,eax;
	}
	assert(VirtualProtect((DWORD*)curr,8,PAGE_EXECUTE_READWRITE,&oldProct)!=0);
	//计算从Lab2跳回msg入口的相对偏移
	DWORD diff = (DWORD)msg-(DWORD)curr-5;
	__asm
	{
		mov ebx,diff;
		mov eax,Lab2;
		inc eax;
		mov [eax],ebx;
	}
Lab2:
	__asm
	{
		_emit 0xe9;
		_emit 0x00;
		_emit 0x00;
		_emit 0x00;
		_emit 0x00;
	}

	return 0;
}