写了个简单的内联API钩子类

最新推荐文章于 2024-06-12 17:20:49 发布

sder3445555

最新推荐文章于 2024-06-12 17:20:49 发布

阅读量789

点赞数

分类专栏： C++ 文章标签： api hook class

本文链接：https://blog.csdn.net/sder3445555/article/details/7985295

版权

C++ 专栏收录该内容

13 篇文章 0 订阅

订阅专栏

class CApiHook
{
public:

	CApiHook():m_lpOldProcAddr(0), m_lpNewProcAddr(0)
	{
		RtlZeroMemory(m_szJmpCode, sizeof(m_szJmpCode));
		RtlZeroMemory(m_szOldCode, sizeof(m_szOldCode));
	}

	BOOL Initial(LPVOID lpOldProcAddr, LPVOID lpNewProcAddr)
	{
		if(!lpOldProcAddr || !lpNewProcAddr)
		{
			m_lpOldProcAddr = NULL;
			m_lpNewProcAddr = NULL;
			RtlZeroMemory(m_szJmpCode, sizeof(m_szJmpCode));
			RtlZeroMemory(m_szOldCode, sizeof(m_szOldCode));
			return FALSE;
		}

		m_lpOldProcAddr = lpOldProcAddr;
		m_lpNewProcAddr = lpNewProcAddr;

#ifdef _WIN64
		m_szJmpCode[0] = 0x48;
		m_szJmpCode[1] = 0xB8;
		m_szJmpCode[2] = (UCHAR)(((ULONG_PTR)lpNewProcAddr) & 0xff);
		m_szJmpCode[3] = (UCHAR)(((ULONG_PTR)lpNewProcAddr >> 8) & 0xff);
		m_szJmpCode[4] = (UCHAR)(((ULONG_PTR)lpNewProcAddr >> 16) & 0xff);
		m_szJmpCode[5] = (UCHAR)(((ULONG_PTR)lpNewProcAddr >> 24) & 0xff);
		m_szJmpCode[6] = (UCHAR)(((ULONG_PTR)lpNewProcAddr >> 32) & 0xff);
		m_szJmpCode[7] = (UCHAR)(((ULONG_PTR)lpNewProcAddr >> 40) & 0xff);
		m_szJmpCode[8] = (UCHAR)(((ULONG_PTR)lpNewProcAddr >> 48) & 0xff);
		m_szJmpCode[9] = (UCHAR)(((ULONG_PTR)lpNewProcAddr >> 56) & 0xff);
		m_szJmpCode[10] = 0xFF;
		m_szJmpCode[11] = 0xE0;
#else
		m_szJmpCode[0] = 0x68;
		m_szJmpCode[1] = (UCHAR)(((ULONG_PTR)lpNewProcAddr) & 0xff);
		m_szJmpCode[2] = (UCHAR)(((ULONG_PTR)lpNewProcAddr >> 8) & 0xff);
		m_szJmpCode[3] = (UCHAR)(((ULONG_PTR)lpNewProcAddr >> 16) & 0xff);
		m_szJmpCode[4] = (UCHAR)(((ULONG_PTR)lpNewProcAddr >> 24) & 0xff);
		m_szJmpCode[5] = 0xC3;
#endif	

		memcpy(m_szOldCode, m_lpOldProcAddr, sizeof(m_szOldCode));
		
		return TRUE;
	}

	BOOL Hook()
	{
		DWORD				dwOldProtect = 0;
		DWORD_PTR			dwWrite = 0;
		
		if(!m_lpOldProcAddr || !m_lpNewProcAddr)
			return FALSE;
		if(!m_szJmpCode[0] || !m_szOldCode[0])
			return FALSE;

		if(!VirtualProtect(m_lpOldProcAddr, sizeof(m_szJmpCode), PAGE_EXECUTE_WRITECOPY, &dwOldProtect))
			return FALSE;
		if(!WriteProcessMemory(GetCurrentProcess(), m_lpOldProcAddr, m_szJmpCode, sizeof(m_szJmpCode), &dwWrite))
			return FALSE;
		if(!VirtualProtect(m_lpOldProcAddr, sizeof(m_szJmpCode), dwOldProtect, &dwOldProtect))
			return FALSE;

		return TRUE;
	}
	
	BOOL UnHook()
	{
		DWORD			dwOldProtect = 0;
		DWORD_PTR		dwWrite = 0;
		
		if(!m_lpOldProcAddr || !m_lpNewProcAddr)
			return FALSE;
		if(!m_szJmpCode[0] || !m_szOldCode[0])
			return FALSE;

		if(!VirtualProtect(m_lpOldProcAddr, sizeof(m_szOldCode), PAGE_EXECUTE_WRITECOPY, &dwOldProtect))
			return FALSE;
		if(!WriteProcessMemory(GetCurrentProcess(), m_lpOldProcAddr, m_szOldCode, sizeof(m_szOldCode), &dwWrite))
			return FALSE;
		if(!VirtualProtect(m_lpOldProcAddr, sizeof(m_szOldCode), dwOldProtect,  &dwOldProtect))
			return FALSE;

		return TRUE;
	}

	LPVOID GetOldFuncAddr()
	{
		return m_lpOldProcAddr;
	}

	LPVOID GetNewFuncAddr()
	{
		return m_lpNewProcAddr;
	}

private:
#ifdef _WIN64
	UCHAR		m_szJmpCode[12];
	UCHAR		m_szOldCode[12];
#else
	UCHAR		m_szJmpCode[6];
	UCHAR		m_szOldCode[6];
#endif
	LPVOID		m_lpOldProcAddr;
	LPVOID		m_lpNewProcAddr;
};