HOOK API的一个类

HOOK API的一个类（JMP法）- -

Tag： HOOK    API的一个类（JMP法）                                          

 

//---------------------------------------------------------------------------
// HookApi_JMP.h
//使用JMP法写的一个HOOK API的类
#include 
 
 

#ifndef _HOOK_API_JMP_
#define _HOOK_API_JMP_

class CHookApi_Jmp  
{
 public: 
 HANDLE hProc; 
 void Unlock(void);
 void Lock(void); 
 BOOL Initialize(LPCTSTR ModuleName, LPCTSTR ApiName, FARPROC lpNewFunc);
 void SetHookOn(void); 
 void SetHookOff(void); 
 CHookApi_Jmp(void); 
 virtual ~CHookApi_Jmp();
 
 protected: 
 BYTE m_OldFunc[8]; 
 BYTE m_NewFunc[8]; 
 FARPROC m_lpHookFunc; 
 CRITICAL_SECTION m_cs;
};
#endif

//---------------------------------------------------------------------------
#pragma hdrstop
#include "HookApi_JMP.h"
#pragma package(smart_init)

//---------------------------------------------------------------------------
CHookApi_Jmp::CHookApi_Jmp(void)
{ 
 InitializeCriticalSection(&m_cs);
}
//---------------------------------------------------------------------------
CHookApi_Jmp::~CHookApi_Jmp()
{ 
 CloseHandle(hProc); 
 DeleteCriticalSection(&m_cs);
}
//---------------------------------------------------------------------------
void CHookApi_Jmp::SetHookOn(void)
{ 
 DWORD dwOldFlag;
 if(VirtualProtectEx(hProc,m_lpHookFunc,5,PAGE_READWRITE,&dwOldFlag))
 {  
  if(WriteProcessMemory(hProc,m_lpHookFunc,m_NewFunc,5,0))  
  {   
   if(VirtualProtectEx(hProc,m_lpHookFunc,5,dwOldFlag,&dwOldFlag))    
    return;  
  } 
 } 
 MessageBox(NULL,"SetHookOn","fail",MB_OK); 
 return;
}
//---------------------------------------------------------------------------
void CHookApi_Jmp::SetHookOff(void)
{ 
 DWORD dwOldFlag; 
 if(VirtualProtectEx(hProc,m_lpHookFunc,5,PAGE_READWRITE,&dwOldFlag)) 
 {  
  if(WriteProcessMemory(hProc,m_lpHookFunc,m_OldFunc,5,0))  
  {   
   if(VirtualProtectEx(hProc,m_lpHookFunc,5,dwOldFlag,&dwOldFlag))    
    return;  
  }
 }
 MessageBox(NULL,"SetHookOff","fail",MB_OK);
 return;
}
//---------------------------------------------------------------------------
BOOL CHookApi_Jmp::Initialize(LPCTSTR ModuleName, LPCTSTR ApiName, FARPROC lpNewFunc)
{
    m_lpHookFunc = GetProcAddress(GetModuleHandle(ModuleName),ApiName);
    hProc = GetCurrentProcess();
    DWORD dwOldFlag;
 if(VirtualProtectEx(hProc,m_lpHookFunc,5,PAGE_READWRITE,&dwOldFlag)) 
 {  
  if(ReadProcessMemory(hProc,m_lpHookFunc,m_OldFunc,5,0))  
  {   
   if(VirtualProtectEx(hProc,m_lpHookFunc,5,dwOldFlag,&dwOldFlag))   
   {    
    m_NewFunc[0]=0xe9;    
    DWORD*pNewFuncAddress;    
    pNewFuncAddress=(DWORD*)&m_NewFunc[1];    
    *pNewFuncAddress=(DWORD)lpNewFunc-(DWORD)m_lpHookFunc-5;    
    return TRUE;   
   }  
  }
 }
 return FALSE;
}
//---------------------------------------------------------------------------
void CHookApi_Jmp::Lock(void) //多线程下使用
{
 EnterCriticalSection(&m_cs);
}
//---------------------------------------------------------------------------
void CHookApi_Jmp::Unlock(void)
{ 
 LeaveCriticalSection(&m_cs);
}
//---------------------------------------------------------------------------