记事本

using System; using System.Runtime.InteropServices; namespace NativeHook.Test { public delegate Int32 MessageBoxW(IntPtr hWnd, [MarshalAs(UnmanagedType.LPWStr)] string lpText, [MarshalAs(UnmanagedType.LPWStr)] string lpCaption, UInt32 uType); public class MessageBoxHook : NtAPIHook { [DllHook("user32", EntryPoint = "MessageBoxW")] public Int32 MessageBox(IntPtr owner, string text, string caption, UInt32 options) { //拦截信息 Console.Title = caption; Console.WriteLine(text); //调用源函数 return Origin.Invoke(owner, text, caption, options); } } } [STAThread] static void Main(string[] args) { using (var hook = new MessageBoxHook()) { //绕过Hook直接调用源函数 hook.Origin(IntPtr.Zero, "111", "222", 0); //调用Api 被Hook MessageBox.Show("Hello world", "666", MessageBoxButtons.YesNoCancel); } //Hook解除拦截不到 MessageBox.Show("Hello world", "666", MessageBoxButtons.YesNoCancel); }

纯C# 实现的 从内存加载动态链接库，支持加壳的DLL，使用方便 class Program { public delegate Int32 CompressHandle(ref Byte dest,ref Int32 len, Byte [] source,Int32 sourcelen); static void Main(string[] args) { Byte[] source = new byte[10000]; Byte[] dest = new byte[10000]; Int32 len = source.Length; Byte[] dllBin = File.ReadAllBytes("zlib1.dll"); using (var dll = new DllLoader()) { if (dll.LoadLibrary(dllBin)) { var Compress = dll.GetProcDelegate("compress"); if (Compress != null) { var result = Compress.Invoke(ref dest[0], ref len, source, len); Console.WriteLine(result); } } } } }

Vb6 开发的 InLineHook (APIHook) 兼容 XP WIN7 SERVER2003 WIN2000 源码

解析M$的Obj文档,Vb生成的 Obj文档，功能齐全 可编辑 源码