Mobile6.1 API Hook问题

void HookOneAPI(LPCTSTR pszCalleeModuleName,PROC pfnOriginApiAddress,PROC pfnDummyFuncAddress,HMODULE hModCallerModule)
{
RETAILMSG(1,(TEXT("--HookOneAPI------1----/n")));

pDosHeader = (PIMAGE_DOS_HEADER)hModCallerModule;
RETAILMSG(1,(TEXT("--HookOneAPI------1--1--/n")));

pNTHeaders = (PIMAGE_NT_HEADERS)((BYTE *)hModCallerModule + pDosHeader->e_lfanew);
RETAILMSG(1,(TEXT("--HookOneAPI------1--2--/n")));
pOptHeader = (PIMAGE_OPTIONAL_HEADER)&(pNTHeaders->OptionalHeader);

RETAILMSG(1,(TEXT("--HookOneAPI------1--3--/n")));
pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((BYTE *)hModCallerModule + pOptHeader->DataDirectory[1].VirtualAddress);

RETAILMSG(1,(TEXT("--HookOneAPI------2----/n")));

while(pImportDescriptor->FirstThunk)
{
char * dllname = (char *)((BYTE *)hModCallerModule + pImportDescriptor->Name);

pThunkData = (PIMAGE_THUNK_DATA)((BYTE *)hModCallerModule + pImportDescriptor->OriginalFirstThunk);

RETAILMSG(1,(TEXT("--HookOneAPI------3----/n")));

int no = 1;
while(pThunkData->u1.Function)
{
char * funname = (char *)((BYTE *)hModCallerModule + (DWORD)pThunkData->u1.AddressOfData + 2);
PDWORD lpAddr = (DWORD *)((BYTE *)hModCallerModule + (DWORD)pImportDescriptor->FirstThunk) +(no-1);

//修改内存的部分
if((*lpAddr) == (int)pfnOriginApiAddress)
{
RETAILMSG(1,(TEXT("--HookOneAPI------4----/n")));

//修改内存页的属性
DWORD dwOLD;
MEMORY_BASIC_INFORMATION mbi;
VirtualQuery(lpAddr,&mbi,sizeof(mbi));
VirtualProtect(lpAddr,sizeof(DWORD),PAGE_READWRITE,&dwOLD);

WriteProcessMemory(GetCurrentProcess(),
lpAddr, &pfnDummyFuncAddress, sizeof(pfnDummyFuncAddress), NULL);
//恢复内存页的属性
VirtualProtect(lpAddr,sizeof(DWORD),dwOLD,0);

return;
}
//---------
no++;
pThunkData++;
}

pImportDescriptor++;
}
}
DWORD GetProcessAddress(LPCTSTR pName)
{
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (INVALID_HANDLE_VALUE == hSnapshot)
{
return 0;
}
PROCESSENTRY32 pe = { sizeof(pe) };
BOOL fOk;
for (fOk = Process32First(hSnapshot, &pe); fOk; fOk = Process32Next(hSnapshot, &pe))
{
if (0 == wcscmp(pe.szExeFile, pName))
{
CloseHandle(hSnapshot);
return pe.th32MemoryBase;
}
}
CloseHandle(hSnapshot);
return 0;
}


BOOL InstallHook(BOOL IsHook)
{
modeStatus = SetKMode(TRUE);
dwPerm = SetProcPermissions(GetCurrentPermissions());

DWORD currHandle = GetProcessAddress(TEXT("cmdcore.exe"));


HookOneAPI(L"coredll.dll",GetProcAddress(GetModuleHandle(TEXT("coredll.dll")),L"DispatchMessageW"),(PROC)&H_DispatchMessageW,(HMODULE)currHandle/*GetModuleHandle(TEXT("console.dll"))*/);


return TRUE;
}





现在代码执行到

RETAILMSG(1,(TEXT("--HookOneAPI------1--1--/n")));

pNTHeaders = (PIMAGE_NT_HEADERS)((BYTE *)hModCallerModule + pDosHeader->e_lfanew);

会出现异常。



我得到的hModCallerModule值是0x24000000，好像是地址访问受限，我通过SetKMode 和 SetProcPermissions 也没有任何改善。



希望大家能给些建议。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。