Windows 7 64位 HookApi例子

最新推荐文章于 2024-08-29 04:17:45 发布
最新推荐文章于 2024-08-29 04:17:45 发布
阅读量372 收藏 1
点赞数
文章标签： 操作系统 c/c++
原文链接：http://www.cnblogs.com/xuesongshu/archive/2013/04/04/hookapi.html
版权

转载请注明来源：http://www.cnblogs.com/xuesongshu/

　　本程序HOOK的API是DispatchMessageA和DispatchMessageW。在HOOK的方法内会还原ESP，调用user32.DispathMessage(A或W)之后再修改ESP，实现的功能是记录消息的详细日志，记录哪个窗口处理过哪些消息。

　　1、新建一个win32 console项目，取名为DoInjection，新建一个DoInjectionMain.h，代码如下：

BOOL SetPrivilege(LPCTSTR lpszPrivilege, BOOL bEnablePrivilege);
BOOL IsVistaOrLater();
BOOL InjectProcess();
BOOL InjectCreateProcess();
void HookGetMessage();
BOOL InjectCreateThread(HANDLE hProcess, LPTHREAD_START_ROUTINE pThreadProc, LPVOID pRemoteBuf);
HANDLE MsicCreateRemoteThread(HANDLE hProcess,LPTHREAD_START_ROUTINE lpStartAddress,LPVOID lpParameter);

typedef void*(__stdcall*LPFN_KernelBaseGetGlobalData)(void);
typedef DWORD (WINAPI *PFNTCREATETHREADEX)
( 
    PHANDLE                 ThreadHandle,	
    ACCESS_MASK             DesiredAccess,	
    LPVOID                  ObjectAttributes,	
    HANDLE                  ProcessHandle,	
    LPTHREAD_START_ROUTINE  lpStartAddress,	
    LPVOID                  lpParameter,	
    BOOL	                CreateSuspended,	
    DWORD                   dwStackSize,	
    DWORD                   dw1, 
    DWORD                   dw2, 
    LPVOID                  Unknown 
);

　　2、新建一个DoInjectionMain.c(不是CPP)，代码如下：

 

#include <windows.h>
#include <stdio.h>
#include <tlhelp32.h>
#include <tchar.h>
#include "DoInjection.h"

#pragma comment(lib,"th32.lib")
#pragma comment(lib,"Advapi32.lib")

//这个路径很有意思，这个路径是相对于目标进程的，而不是自身进程。
//所以要嘛写成绝对路径，要嘛写成相对于目标进程的相对路径。
//如果写成相对于自身的路径就要麻烦了，本程序就找不到DLL文件了。
const char *pcDllName="MfcHookApi.dll";        //DLL文件的路径
HANDLE hSnap=0,hThreadHandle=0,hRemoteProcess32=0,hTokenHandle=0;
PROCESSENTRY32 procEntry32;
BOOL bNext=FALSE,bWrittenResult=FALSE;
TOKEN_PRIVILEGES tokenPower;
LUID luidPower;
LPVOID pRemoteBuf=NULL;
FARPROC fnDllKernel32;
size_t sizeWritten=0;
DWORD dwThreadId=0;

char* pcProsessName="DoWin32Test.exe";   //要注入的进程名(目标进程名)

int main()
{
	IsVistaOrLater();
    SetPrivilege(SE_DEBUG_NAME,TRUE);
	//InjectProcess();
	InjectCreateProcess();
	getchar();
    return 0;
}

BOOL SetPrivilege(LPCTSTR lpszPrivilege, BOOL bEnablePrivilege) 
{
    TOKEN_PRIVILEGES tp;
    HANDLE hToken;
    LUID luid;
    if( !OpenProcessToken(GetCurrentProcess(),
                          TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, 
			              &hToken) )
    {
        _tprintf("OpenProcessToken error: %u\r\n", GetLastError());
        return FALSE;
    }
    if( !LookupPrivilegeValue(NULL,
                              lpszPrivilege,
                              &luid) )
    {
        _tprintf("LookupPrivilegeValue error: %u\r\n", GetLastError() ); 
        return FALSE; 
    }
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    if( bEnablePrivilege )
        tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    else
        tp.Privileges[0].Attributes = 0;
    if( !AdjustTokenPrivileges(hToken, 
                               FALSE, 
                               &tp, 
                               sizeof(TOKEN_PRIVILEGES), 
                               (PTOKEN_PRIVILEGES) NULL, 
                               (PDWORD) NULL) )
    { 
        _tprintf("AdjustTokenPrivileges error: %u\r\n", GetLastError() ); 
        return FALSE; 
    } 
    if( GetLastError() == ERROR_NOT_ALL_ASSIGNED )
    {
        _tprintf("The token does not have the specified privilege. \r\n");
        return FALSE;
    } 
    return TRUE;
}

BOOL IsVistaOrLater()
{
	
    OSVERSIONINFO osvi;
    ZeroMemory(&osvi, sizeof(OSVERSIONINFO));
	//OSVERSIONINFOEX osvix;
	//ZeroMemory(&osvix,sizeof(OSVERSIONINFOEX));
    osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
    GetVersionEx(&osvi);
	printf("network terminal v%ld.%ld,%s,platform:%ld,build number:%ld\r\n",osvi.dwMajorVersion,osvi.dwMinorVersion,osvi.szCSDVersion,osvi.dwPlatformId,osvi.dwBuildNumber);
    if( osvi.dwMajorVersion >= 6 )
        return TRUE;
    return FALSE;
}

BOOL InjectProcess()
{
	procEntry32.dwSize = sizeof(PROCESSENTRY32);
    hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    bNext=Process32First(hSnap, &procEntry32);
    while(bNext)
    {
        if(!stricmp(procEntry32.szExeFile,pcProsessName))        //--->>
        {
            hRemoteProcess32=OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_WRITE|PROCESS_VM_OPERATION,1,procEntry32.th32ProcessID);
            break;
        }
        bNext=Process32Next(hSnap, &procEntry32);
    }
    CloseHandle(hSnap);
	pRemoteBuf=VirtualAllocEx(hRemoteProcess32,NULL,strlen(pcDllName),MEM_COMMIT,PAGE_READWRITE);
    bWrittenResult=WriteProcessMemory(hRemoteProcess32,pRemoteBuf,pcDllName,strlen(pcDllName),(ULONG*)&sizeWritten);
	if (bWrittenResult)
	{
		printf("InjectCreate()-->WriteProcessMemory() Success,written size:%ld,buffer address:%16X\r\n",sizeWritten,pRemoteBuf);
	}
	else
	{
		printf("InjectCreate()-->WriteProcessMemory() Error:%ld\r\n",GetLastError());
	}
    fnDllKernel32=GetProcAddress(GetModuleHandle("kernel32.dll"),"LoadLibraryA");

	//hThreadHandle=CreateRemoteThread(hRemoteProcess32,NULL,0,(LPTHREAD_START_ROUTINE)fnDllKernel32,pAllocMemory,0,&dwThreadId);
	//if (hThreadHandle&&dwThreadId)
	//{
	//	printf("CreateRemoteThread Success,Handle:%ld,Thread Id:%ld\r\n",hThreadHandle,dwThreadId);
	//} 
	//else
	//{
	//	printf("CreateRemoteThread Error:%ld\r\n",GetLastError());
	//}
    InjectCreateThread(hRemoteProcess32, (LPTHREAD_START_ROUTINE)fnDllKernel32, pRemoteBuf);
	//MsicCreateRemoteThread(hRemoteProcess32,(LPTHREAD_START_ROUTINE)fnDllKernel32,pRemoteBuf);
    VirtualFreeEx(hRemoteProcess32, pRemoteBuf, 0, MEM_RELEASE);;
    CloseHandle(hRemoteProcess32);
    return TRUE;
}

BOOL InjectCreateProcess()
{
	PROCESS_INFORMATION pi;
	STARTUPINFO si;
	procEntry32.dwSize = sizeof(PROCESSENTRY32);
	ZeroMemory(&pi,sizeof(PROCESS_INFORMATION));
	ZeroMemory(&si,sizeof(STARTUPINFO));
	si.cb=sizeof(STARTUPINFO);

    CreateProcess(NULL,pcProsessName,NULL,NULL,false,0,NULL,NULL,&si,&pi);
	hRemoteProcess32=pi.hProcess;
	printf("waiting for 30 seconds please.\r\n");
	for (int i=0;i<30;i++)
	{
		Sleep(1000);
		printf(".");
	}
	printf("\r\n");
	pRemoteBuf=VirtualAllocEx(hRemoteProcess32,NULL,strlen(pcDllName),MEM_COMMIT,PAGE_READWRITE);
    bWrittenResult=WriteProcessMemory(hRemoteProcess32,pRemoteBuf,pcDllName,strlen(pcDllName),(ULONG*)&sizeWritten);
	if (bWrittenResult)
	{
		printf("InjectCreate()-->WriteProcessMemory() Success,written size:%ld,buffer address:%16X\r\n",sizeWritten,pRemoteBuf);
	}
	else
	{
		printf("InjectCreate()-->WriteProcessMemory() Error:%ld\r\n",GetLastError());
	}
    fnDllKernel32=GetProcAddress(GetModuleHandle("kernel32.dll"),"LoadLibraryA");

	//hThreadHandle=CreateRemoteThread(hRemoteProcess32,NULL,0,(LPTHREAD_START_ROUTINE)fnDllKernel32,pAllocMemory,0,&dwThreadId);
	//if (hThreadHandle&&dwThreadId)
	//{
	//	printf("CreateRemoteThread Success,Handle:%ld,Thread Id:%ld\r\n",hThreadHandle,dwThreadId);
	//} 
	//else
	//{
	//	printf("CreateRemoteThread Error:%ld\r\n",GetLastError());
	//}
    //InjectCreateThread(hRemoteProcess32, (LPTHREAD_START_ROUTINE)fnDllKernel32, pRemoteBuf);
	MsicCreateRemoteThread(hRemoteProcess32,(LPTHREAD_START_ROUTINE)fnDllKernel32,pRemoteBuf);
    //VirtualFreeEx(hRemoteProcess32, pRemoteBuf, 0, MEM_RELEASE);;
    //CloseHandle(hRemoteProcess32);
    return TRUE;
}

BOOL InjectCreateThread(HANDLE hProcess, LPTHREAD_START_ROUTINE pThreadProc, LPVOID pRemoteBuf)
{
    HANDLE      hThread = NULL;
    FARPROC     pFunc = NULL;
    if( IsVistaOrLater() )    // Vista, 7, Server2008
    {
        pFunc = GetProcAddress(GetModuleHandle("ntdll.dll"), "NtCreateThreadEx");
        if( pFunc == NULL )
        {
            printf("InjectCreateThread()-->GetProcAddress(\"NtCreateThreadEx\") Error %d\r\n",GetLastError());
            return FALSE;
        }
        ((PFNTCREATETHREADEX)pFunc)(&hThread,
                                    0x1FFFFF,
                                    NULL,
                                    hProcess,
                                    pThreadProc,
                                    pRemoteBuf,
                                    FALSE,
                                    NULL,
                                    NULL,
                                    NULL,
                                    NULL);
        if( hThread == NULL )
        {
            printf("InjectCreateThread()-->NtCreateThreadEx() Error: %d\r\n", GetLastError());
            return FALSE;
        }
		else
		{
			printf("InjectCreateThread()-->NtCreateThreadEx() Success,Thread Id:%ld\r\n",hThread);
		}
    }
    else                    // 2000, XP, Server2003
    {
        hThread = CreateRemoteThread(hProcess, 
                                     NULL, 
                                     0, 
                                     pThreadProc, 
                                     pRemoteBuf, 
                                     0, 
                                     NULL);
        if( hThread == NULL )
        {
            printf("InjectCreateThread()-->CreateRemoteThread() Error: %d\r\n", GetLastError());
            return FALSE;
        }
		else
		{
			printf("InjectCreateThread()-->CreateRemoteThread() Success,Thread Id:%ld\r\n",hThread);
		}
    }
	if( WAIT_FAILED == WaitForSingleObject(hThread, INFINITE) )
    {
        printf("InjectCreateThread() : WaitForSingleObject() Error: %d\r\n", GetLastError());
        return FALSE;
    }
    return TRUE;
}

typedef void*(__stdcall*LPFN_KernelBaseGetGlobalData)(void);
HANDLE MsicCreateRemoteThread(HANDLE hProcess,LPTHREAD_START_ROUTINE lpStartAddress,LPVOID lpParameter)
{
    OSVERSIONINFOEX stOSVersionInfoEx= {0};
    FARPROC pCreateRemoteThreadEx=NULL;
    LPFN_KernelBaseGetGlobalData pKernelBaseGetGlobalData=NULL;
    UCHAR *pCreateRemoteThread=NULL;
    UCHAR *pGlobalData=NULL;
    UCHAR *pMisc=NULL;
    HMODULE hKernelBase=NULL;
    HMODULE hKernel32=NULL;
    HANDLE hNewThread=NULL;
    ULONG ulIndex=0;
    WORD wCode=0;
    do
    {
        stOSVersionInfoEx.dwOSVersionInfoSize=sizeof(OSVERSIONINFOEX);
        if(!GetVersionEx((OSVERSIONINFO*)&stOSVersionInfoEx))
        {
            break;
        }
//vista以前的系统不存在这个问题
        if((stOSVersionInfoEx.dwMajorVersion<6)||(GetCurrentProcess()==hProcess))
        {
            hNewThread=CreateRemoteThread(hProcess,NULL,0,lpStartAddress,lpParameter,0,&dwThreadId);
			if (dwThreadId)
			{
				printf("MsicCreateRemoteThread()-->CreateRemoteThread() Success,Thread Id:%08X\r\n",dwThreadId);
			} 
			else
			{
				printf("MsicCreateRemoteThread()-->CreateRemoteThread() Error:%ld\r\n",GetLastError());
			}
			
            break;
        }
        if((stOSVersionInfoEx.dwMajorVersion==6)&&(0==stOSVersionInfoEx.dwMinorVersion))
        {
//vista
            hKernel32=LoadLibraryA("Kernel32.dll");
            pCreateRemoteThread=(UCHAR*)GetProcAddress(hKernel32,"CreateRemoteThread");
            for(ulIndex=0; ulIndex<0x300; ulIndex+=1)
            {
                wCode=*((USHORT*)(pCreateRemoteThread+ulIndex));
#ifdef _WIN64
                if(0x3D80==wCode)
                {
                    pMisc=(*((ULONG*)(pCreateRemoteThread+ulIndex+2)))+(pCreateRemoteThread+ulIndex+7);
                    break;
                }
#else
                if(0x1D38==wCode)
                {
                    pMisc=(UCHAR*)(*((ULONG*)(pCreateRemoteThread+ulIndex+2)));
                    break;
                }
#endif
            }
        }
        else if((stOSVersionInfoEx.dwMajorVersion==6)&&(1==stOSVersionInfoEx.dwMinorVersion))
        {
//win7
            hKernelBase=LoadLibraryW(L"KernelBase.dll");
            if(NULL==hKernelBase)
            {
                break;
            }
            pKernelBaseGetGlobalData=(LPFN_KernelBaseGetGlobalData)GetProcAddress(hKernelBase,"KernelBaseGetGlobalData");
			printf("MsicCreateRemoteThread()-->KernelBaseGetGlobalData:%08X\r\n",pKernelBaseGetGlobalData);
            if(NULL==pKernelBaseGetGlobalData)
            {
                break;
            }
            pGlobalData=(UCHAR*)pKernelBaseGetGlobalData();
            if(NULL==pGlobalData)
            {
                break;
            }
#ifdef _WIN64
            pMisc=pGlobalData+0x5C;
#else
            pMisc=pGlobalData+0x30;
#endif
        }
        else
        {
//手上的win8 Build 8250 没有session 隔离
        }
//
        if(NULL==pMisc)
        {
            break;
        }
		printf("MsicCreateRemoteThread()-->pMisc: %08X\r\n",pMisc);
//Patch
        *pMisc=1;
//xx
        hNewThread=CreateRemoteThread(hProcess,NULL,0,lpStartAddress,lpParameter,0,&dwThreadId);
		if (dwThreadId)
		{
			printf("MsicCreateRemoteThread()-->CreateRemoteThread() Success,Thread Id:%08X\r\n",dwThreadId);
		} 
		else
		{
			printf("MsicCreateRemoteThread()-->CreateRemoteThread() Error:%ld\r\n",GetLastError());
		}
//UnPatch
        *pMisc=0;
    }
    while(FALSE);
    if(NULL!=hKernelBase)
    {
		printf("MsicCreateRemoteThread()-->hKernelBase:%08X\r\n",hKernelBase);
        FreeLibrary(hKernelBase);
        hKernelBase=NULL;
    }
    return hNewThread;
}

void HookGetMessage()
{
	HOOKPROC hp;
	//SetWindowsHookEx(WH_GETMESSAGE,hp,)
}

　　3、新建一个mfc的DLL项目，命名为 MfcHookApi.dll，MfcHookApi.h的代码如下：

// MfcHookApi.h : main header file for the MFCHOOKAPI DLL
//

#if !defined(AFX_MFCHOOKAPI_H__6A8FC5E5_0E77_4B74_8344_CB9CA22141E5__INCLUDED_)
#define AFX_MFCHOOKAPI_H__6A8FC5E5_0E77_4B74_8344_CB9CA22141E5__INCLUDED_

#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000

#ifndef __AFXWIN_H__
	#error include 'stdafx.h' before including this file for PCH
#endif

#include "resource.h"		// main symbols

/
// CMfcHookApiApp
// See MfcHookApi.cpp for the implementation of this class
//

class CMfcHookApiApp : public CWinApp
{
public:
	CMfcHookApiApp();

// Overrides
	// ClassWizard generated virtual function overrides
	//{{AFX_VIRTUAL(CMfcHookApiApp)
	public:
	virtual BOOL InitInstance();
	//}}AFX_VIRTUAL

	//{{AFX_MSG(CMfcHookApiApp)
		// NOTE - the ClassWizard will add and remove member functions here.
		//    DO NOT EDIT what you see in these blocks of generated code !
	//}}AFX_MSG
	DECLARE_MESSAGE_MAP()
};

extern "C" __declspec(dllexport) void ActiveHook();
extern "C" __declspec(dllexport) void InstallHook4Api(HWND hwnd);

int* addrMsgBoxA=(int*)MessageBoxA;
int* addrMsgBoxW=(int*)MessageBoxW;
int WINAPI HookMessageBoxA(HWND hWnd, LPCSTR lpText,LPCSTR lpCaption, UINT uType);
int WINAPI HookMessageBoxW(HWND hWnd, LPCWSTR lpText,LPCWSTR lpCaption, UINT uType);
void SetHookMessageBox(HMODULE hModule);

typedef int(WINAPI* PfnMessageBox)(HWND,LPCSTR,LPCSTR,UINT);

int* addrDispatchA=(int*)DispatchMessageA;
int* addrDispatchW=(int*)DispatchMessageW;
LRESULT WINAPI HookDispatchMessageA(MSG* msg);
LRESULT WINAPI HookDispatchMessageW(MSG* msg);
void SetHookDispatchMessage(HMODULE hModule);

typedef LRESULT (WINAPI* DLLDISPATCHMESSAGE)(MSG* msg);
/

//{{AFX_INSERT_LOCATION}}
// Microsoft Visual C++ will insert additional declarations immediately before the previous line.

#endif // !defined(AFX_MFCHOOKAPI_H__6A8FC5E5_0E77_4B74_8344_CB9CA22141E5__INCLUDED_)

　　5、MfcHookApi.cpp代码如下：

// MfcHookApi.cpp : Defines the initialization routines for the DLL.
//

#include "stdafx.h"
#include "MfcHookApi.h"
#include <TlHelp32.h>
#include <stdio.h>
#include <Shlwapi.h>

#pragma comment(lib,"shlwapi.lib")
#pragma comment(lib,"th32.lib")

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[]=__FILE__;
#endif

//
//	Note!
//
//		If this DLL is dynamically linked against the MFC
//		DLLs,any functions exported from this DLL which
//		call into MFC must have the AFX_MANAGE_STATE macro
//		added at the very beginning of the function.
//
//		For example:
//
//		extern "C" BOOL PASCAL EXPORT ExportedFunction()
//		{
//			AFX_MANAGE_STATE(AfxGetStaticModuleState());
//			// normal function body here
//		}
//
//		It is very important that this macro appear in each
//		function,prior to any calls into MFC.  This means that
//		it must appear as the first statement within the 
//		function,even before any object variable declarations
//		as their constructors may generate calls into the MFC
//		DLL.
//
//		Please see MFC Technical Notes 33 and 58 for additional
//		details.
//

/
// CMfcHookApiApp

BEGIN_MESSAGE_MAP(CMfcHookApiApp,CWinApp)
	//{{AFX_MSG_MAP(CMfcHookApiApp)
		// NOTE - the ClassWizard will add and remove mapping macros here.
		//    DO NOT EDIT what you see in these blocks of generated code!
	//}}AFX_MSG_MAP
END_MESSAGE_MAP()

/
// CMfcHookApiApp construction

CMfcHookApiApp::CMfcHookApiApp()
{
	// TODO: add construction code here,
	// Place all significant initialization in InitInstance
}

/
// The one and only CMfcHookApiApp object

CMfcHookApiApp theApp;

HHOOK hHook=0;
HINSTANCE hinstDll=0;
DWORD dwCurrentPid=0;
DWORD TargetPid=0;
BOOL bApiHook=false;	
FARPROC fpApiAddrA=NULL,fpApiAddrW=NULL;
BYTE btOldCodeA[5]={0,0,0,0,0};
BYTE btNewCodeA[5]={0,0,0,0,0};
BYTE btOldCodeW[5]={0,0,0,0,0};
BYTE btNewCodeW[5]={0,0,0,0,0};
DWORD dwProtect=0;
HANDLE hRemoteProcess32=0,hSnap=0;
//#pragma data_seg()
//#pragma comment(linker,"/SECTION:YuKai,rws")
int nHookCount=0;

char* pcProsessName="DoWin32Test.exe"; 

//---------------------------------------------------------------------------
// 空的钩子函数
LRESULT WINAPI HookProc(int nCode,WPARAM wParam,LPARAM lParam)
{
	return CallNextHookEx(hHook,nCode,wParam,lParam);
}

extern "C" __declspec(dllexport) void ActiveHook()
{
	AFX_MANAGE_STATE(AfxGetStaticModuleState());
}

//---------------------------------------------------------------------------
//本函数一定要用WINAPI(即__stdcall)，表示本函数自己平衡堆栈(和win32 API一致)
int WINAPI HookMessageBoxA(HWND hWnd,LPCTSTR lpText,LPCTSTR lpCaption,UINT uType) 
{
	nHookCount++;
	printf("HookMessageBoxA hook Success......%d\r\n",nHookCount);
	return 1;
	//return ((PfnMessageBox)(addrMsgBoxA))(NULL,"HOOK成功","HOOK成功",MB_ICONINFORMATION);
}

//---------------------------------------------------------------------------
//本函数一定要用WINAPI(即__stdcall)，表示本函数自己平衡堆栈(和win32 API一致)
int WINAPI HookMessageBoxW(HWND hWnd,LPCWSTR lpText,LPCWSTR lpCaption,UINT uType) 
{
	
	nHookCount++;
	printf("HookMessageBoxW hook Success......%d\r\n",nHookCount);
	return 1;
	//return ((PfnMessageBox)(addrMsgBoxW))(NULL,"HOOK成功","HOOK成功",MB_ICONINFORMATION);
}


//---------------------------------------------------------------------------
// 安装卸载空钩子(ProcessID=NULL：卸载)
extern "C" __declspec(dllexport) void InstallHook4Api(HWND hwnd)
{
	AFX_MANAGE_STATE(AfxGetStaticModuleState());
	//GetWindowThreadProcessId(hwnd,&TargetPid);
	//只hook窗口句柄为hwnd的线程
	if(hwnd)
		hHook=SetWindowsHookEx(WH_GETMESSAGE,(HOOKPROC)HookProc,hinstDll,GetWindowThreadProcessId(hwnd,&TargetPid));
	else
	{
		if(hHook)
			UnhookWindowsHookEx(hHook);
	}
}

void SetHookMessageBox(HMODULE hModule)
{
	HMODULE hModuleUser32=0;
	char cArrDllName[256]; 
	hinstDll=(HINSTANCE)hModule;
	BOOL bNext=FALSE;
	PROCESSENTRY32 procEntry32;
	//获取目标进程句柄。
	procEntry32.dwSize=sizeof(PROCESSENTRY32);
	hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
    bNext=Process32First(hSnap,&procEntry32);
    while(bNext)
    {
        if(!stricmp(procEntry32.szExeFile,pcProsessName))        //--->>
        {
            hRemoteProcess32=OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_WRITE|PROCESS_VM_OPERATION,1,procEntry32.th32ProcessID);
            break;
        }
        bNext=Process32Next(hSnap,&procEntry32);
    }
    CloseHandle(hSnap);
	dwCurrentPid=procEntry32.th32ProcessID;
	//载入需要HOOK的DLL并保存原始ESP
	hModuleUser32=LoadLibrary("user32.dll");
	fpApiAddrA=GetProcAddress(hModuleUser32,"MessageBoxA");
	if(fpApiAddrA==NULL) 
		return;		
	/*MessageBoxA原前5字节存至OldCode[5]*/
	_asm
	{
		pushad
		lea edi,btOldCodeA
		mov esi,fpApiAddrA
		cld
		movsd
		movsb
		popad
	}
	/*MessageBoxA新前5字节存至 NewCode[5]*/
	btNewCodeA[0]=0xe9;
	_asm
	{
		lea eax,HookMessageBoxA
		mov ebx,fpApiAddrA
		sub eax,ebx
		sub eax,5
		mov dword ptr [btNewCodeA+1],eax
	}
	//修改ESP
	/*改写MessageBoxA()的前5个字节*/
	VirtualProtectEx(hRemoteProcess32,fpApiAddrA,5,PAGE_READWRITE,&dwProtect);
	WriteProcessMemory(hRemoteProcess32,fpApiAddrA,btNewCodeA,5,0);
	VirtualProtectEx(hRemoteProcess32,fpApiAddrA,5,dwProtect,&dwProtect);
	//载入需要HOOK的DLL并保存原始ESP
	fpApiAddrW=GetProcAddress(hModuleUser32,"MessageBoxW");
	if(fpApiAddrW==NULL) 
		return;		
	/*MessageBoxA原前5字节存至OldCode[5]*/
	_asm
	{
		pushad
		lea edi,btOldCodeW
		mov esi,fpApiAddrW
		cld
		movsd
		movsb
		popad
	}
	/*MessageBoxW新前5字节存至 NewCode[5]*/
	btNewCodeW[0]=0xe9;
	_asm
	{
		lea eax,HookMessageBoxW
		mov ebx,fpApiAddrW
		sub eax,ebx
		sub eax,5
		mov dword ptr [btNewCodeW+1],eax
	}
	/*改写MessageBoxA()的前5个字节*/
	//修改ESP
	VirtualProtectEx(hRemoteProcess32,fpApiAddrW,5,PAGE_READWRITE,&dwProtect);
	WriteProcessMemory(hRemoteProcess32,fpApiAddrW,btNewCodeW,5,0);
	VirtualProtectEx(hRemoteProcess32,fpApiAddrW,5,dwProtect,&dwProtect);

	bApiHook=true;
	//增加引用次数后立即卸钩(目的:卸钩后保留该dll存在于目标进程中)
	GetModuleFileName((HINSTANCE)hModule,cArrDllName,256);
	LoadLibrary(cArrDllName);
	//只能由目标程序卸钩，否则目标程序有可能来不及加载Hook进来的dll
	if(hHook && (dwCurrentPid==TargetPid))
		UnhookWindowsHookEx(hHook);
    
}

void SetHookDispatchMessage(HMODULE hModule)
{
	HMODULE hModuleUser32=0;
	char cArrDllName[256]; 
	hinstDll=(HINSTANCE)hModule;
	BOOL bNext=FALSE;
	PROCESSENTRY32 procEntry32;
	//获取目标进程句柄。
	procEntry32.dwSize=sizeof(PROCESSENTRY32);
	hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
    bNext=Process32First(hSnap,&procEntry32);
    while(bNext)
    {
        if(!stricmp(procEntry32.szExeFile,pcProsessName))
        {
            hRemoteProcess32=OpenProcess(PROCESS_CREATE_THREAD|PROCESS_VM_WRITE|PROCESS_VM_OPERATION,1,procEntry32.th32ProcessID);
            break;
        }
        bNext=Process32Next(hSnap,&procEntry32);
    }
    CloseHandle(hSnap);
	dwCurrentPid=procEntry32.th32ProcessID;
	//载入需要HOOK的DLL并保存原始ESP
	hModuleUser32=LoadLibrary("user32.dll");
	fpApiAddrA=GetProcAddress(hModuleUser32,"DispatchMessageA");
	if(fpApiAddrA==NULL) 
		return;		
	/*MessageBoxA原前5字节存至OldCode[5]*/
	_asm
	{
		pushad
		lea edi,btOldCodeA
		mov esi,fpApiAddrA
		cld
		movsd
		movsb
		popad
	}
	/*MessageBoxA新前5字节存至 NewCode[5]*/
	btNewCodeA[0]=0xe9;
	_asm
	{
		lea eax,HookDispatchMessageA
		mov ebx,fpApiAddrA
		sub eax,ebx
		sub eax,5
		mov dword ptr [btNewCodeA+1],eax
	}
	//修改ESP
	/*改写MessageBoxA()的前5个字节*/
	VirtualProtectEx(hRemoteProcess32,fpApiAddrA,5,PAGE_READWRITE,&dwProtect);
	WriteProcessMemory(hRemoteProcess32,fpApiAddrA,btNewCodeA,5,0);
	VirtualProtectEx(hRemoteProcess32,fpApiAddrA,5,dwProtect,&dwProtect);

	//载入需要HOOK的DLL并保存原始ESP
	fpApiAddrW=GetProcAddress(hModuleUser32,"DispatchMessageW");
	if(fpApiAddrA==NULL) 
		return;		
	/*MessageBoxA原前5字节存至OldCode[5]*/
	_asm
	{
		pushad
		lea edi,btOldCodeW
		mov esi,fpApiAddrW
		cld
		movsd
		movsb
		popad
	}
	/*MessageBoxW新前5字节存至 NewCode[5]*/
	btNewCodeW[0]=0xe9;
	_asm
	{
		lea eax,HookDispatchMessageW
		mov ebx,fpApiAddrW
		sub eax,ebx
		sub eax,5
		mov dword ptr [btNewCodeW+1],eax
	}
	/*改写MessageBoxA()的前5个字节*/
	//修改ESP
	VirtualProtectEx(hRemoteProcess32,fpApiAddrW,5,PAGE_READWRITE,&dwProtect);
	WriteProcessMemory(hRemoteProcess32,fpApiAddrW,btNewCodeW,5,0);
	VirtualProtectEx(hRemoteProcess32,fpApiAddrW,5,dwProtect,&dwProtect);

	bApiHook=true;
	//增加引用次数后立即卸钩(目的:卸钩后保留该dll存在于目标进程中)
	GetModuleFileName((HINSTANCE)hModule,cArrDllName,256);
	LoadLibrary(cArrDllName);
	//只能由目标程序卸钩，否则目标程序有可能来不及加载Hook进来的dll
	if(hHook && (dwCurrentPid==TargetPid))
		UnhookWindowsHookEx(hHook);
    
}

LRESULT WINAPI HookDispatchMessageA(MSG* msg)
{
	CString szFormat="";
	CString szLog="";
	CTime time;
	CString szFileName="";
	DWORD dwFlag=0;

	RECT rc;
	TCHAR szCaption[128];
	//HMODULE hDll=0;
	//DLLDISPATCHMESSAGE dispatch;
	LRESULT lr=0;
	//hDll=LoadLibrary("user32.dll");
	//if (hDll)
	//{
	//	dispatch=(DLLDISPATCHMESSAGE)GetProcAddress(hDll,"DispatchMessageA");
	//	if (dispatch)
	//	{
	//		lr=(dispatch)(msg);
	//	}
	//}
	VirtualProtectEx(hRemoteProcess32,fpApiAddrA,5,PAGE_READWRITE,&dwProtect);
	WriteProcessMemory(hRemoteProcess32,fpApiAddrA,btOldCodeA,5,0);
	VirtualProtectEx(hRemoteProcess32,fpApiAddrA,5,dwProtect,&dwProtect);
	lr=DispatchMessageA(msg);

	//写日志
	szFormat="%-16X%-16X%-16X%-16X%-16d%-16d%-16X%-16d%-16d%-128s\r\n";
	memset(szCaption,0,128);
	if (IsWindow(msg->hwnd))
	{
		GetWindowRect(msg->hwnd,&rc);
		GetWindowText(msg->hwnd,szCaption,128);
		szLog.Format(szFormat,msg->hwnd,msg->message,msg->wParam,msg->wParam,msg->pt.x,msg->pt.y,msg->time,rc.right,rc.bottom,szCaption);
	}
	else
	{
		szLog.Format(szFormat,msg->hwnd,msg->message,msg->wParam,msg->wParam,msg->pt.x,msg->pt.y,msg->time,-1,-1,szCaption);
	}

	time=CTime::GetCurrentTime();
	szFileName=time.Format("%Y%m%d%H");
	szFileName.Insert(0,"C:\\DM");
	szFileName+=".log";
	dwFlag=CFile::modeReadWrite|CFile::shareDenyRead;
	if (!PathFileExists(szFileName))
	{
		dwFlag|=CFile::modeCreate;
	} 
	CFile fileLog(szFileName,dwFlag);
	fileLog.SeekToEnd();
	fileLog.Write(szLog,szLog.GetLength());
	fileLog.Flush();
	fileLog.Close();

	//重新HOOK以便写日志
	VirtualProtectEx(hRemoteProcess32,fpApiAddrA,5,PAGE_READWRITE,&dwProtect);	
	WriteProcessMemory(hRemoteProcess32,fpApiAddrA,btNewCodeA, 5, 0);
	VirtualProtectEx(hRemoteProcess32,fpApiAddrA,5,dwProtect,&dwProtect);
	return lr;
}

LRESULT WINAPI HookDispatchMessageW(MSG* msg)
{
	CString szFormat="";
	CString szLog="";
	CTime time;
	CString szFileName="";
	DWORD dwFlag=0;

	RECT rc;
	DWORD dwThreadId=0;
	TCHAR szCaption[128];
	//HMODULE hDll=0;
	//DLLDISPATCHMESSAGE dispatch;
	LRESULT lr=0;
	//hDll=LoadLibrary("user32.dll");
	//if (hDll)
	//{
	//	dispatch=(DLLDISPATCHMESSAGE)GetProcAddress(hDll,"DispatchMessageW");
	//	if (dispatch)
	//	{
	//		lr=(dispatch)(msg);
	//	}
	//}
	//恢复HOOK
	VirtualProtectEx(hRemoteProcess32,fpApiAddrW,5,PAGE_READWRITE,&dwProtect);
	WriteProcessMemory(hRemoteProcess32,fpApiAddrW,btOldCodeW,5,0);
	VirtualProtectEx(hRemoteProcess32,fpApiAddrW,5,dwProtect,&dwProtect);
	lr=DispatchMessageW(msg);

	szFormat="%-16X%-16X%-16X%-16X%-16d%-16d%-16X%-16d%-16d%-16d%-128s\r\n";
	memset(szCaption,0,128);
	dwThreadId=GetCurrentThreadId();
	if (IsWindow(msg->hwnd))
	{
		GetWindowRect(msg->hwnd,&rc);
		GetWindowText(msg->hwnd,szCaption,128);
		szLog.Format(szFormat,msg->hwnd,msg->message,msg->wParam,msg->wParam,msg->pt.x,msg->pt.y,msg->time,rc.right,rc.bottom,dwThreadId,szCaption);
	}
	else
	{
		szLog.Format(szFormat,msg->hwnd,msg->message,msg->wParam,msg->wParam,msg->pt.x,msg->pt.y,msg->time,-1,-1,dwThreadId,szCaption);
	}

	time=CTime::GetCurrentTime();
	szFileName=time.Format("%Y%m%d%H");
	szFileName.Insert(0,"C:\\DM");
	szFileName+=".log";
	dwFlag=CFile::modeReadWrite|CFile::shareDenyRead;
	if (!PathFileExists(szFileName))
	{
		dwFlag|=CFile::modeCreate;
	} 
	CFile fileLog(szFileName,dwFlag);
	fileLog.SeekToEnd();
	fileLog.Write(szLog,szLog.GetLength());
	fileLog.Flush();
	fileLog.Close();

	//重新HOOK以便写日志
	VirtualProtectEx(hRemoteProcess32,fpApiAddrW,5,PAGE_READWRITE,&dwProtect);	
	WriteProcessMemory(hRemoteProcess32,fpApiAddrW,btNewCodeW, 5, 0);
	VirtualProtectEx(hRemoteProcess32,fpApiAddrW,5,dwProtect,&dwProtect);
	return lr;
}

BOOL CMfcHookApiApp::InitInstance() 
{
	// TODO: Add your specialized code here and/or call the base class
	SetHookDispatchMessage(GetModuleHandle(NULL));
	//SetHookMessageBox(GetModuleHandle(NULL));

	CString szFormat="";
	CString szLog="";
	CTime time;
	CString szFileName="";
	DWORD dwFlag=0;

	szFormat="%-16s%-16s%-16s%-16s%-16s%-16s%-16s%-16s%-16s%-16s%-128s\r\n";
	szLog.Format(szFormat,"hwnd","message","wparam","lparam","mouse.x","mouse.y","message.time","client.width","client.height","thread id","window.caption");
	time=CTime::GetCurrentTime();
	szFileName=time.Format("%Y%m%d%H");
	szFileName.Insert(0,"C:\\DM");
	szFileName+=".log";
	dwFlag=CFile::modeReadWrite|CFile::shareDenyRead;
	if (!PathFileExists(szFileName))
	{
		dwFlag|=CFile::modeCreate;
	} 
	CFile fileLog(szFileName,dwFlag);
	fileLog.SeekToEnd();
	fileLog.Write(szLog,szLog.GetLength());
	fileLog.Flush();
	fileLog.Close();

	return CWinApp::InitInstance();
}

　　5、新建一个测试程序：WIN32项目，取名为：DoWin32Test，代码如下：

// DoWin32Test.cpp : Defines the entry point for the application.
//

#include "stdafx.h"
#include "resource.h"

#define MAX_LOADSTRING 100

// Global Variables:
HINSTANCE hInst;								// current instance
TCHAR szTitle[MAX_LOADSTRING];								// The title bar text
TCHAR szWindowClass[MAX_LOADSTRING];								// The title bar text

// Foward declarations of functions included in this code module:
ATOM				MyRegisterClass(HINSTANCE hInstance);
BOOL				InitInstance(HINSTANCE, int);
LRESULT CALLBACK	WndProc(HWND, UINT, WPARAM, LPARAM);
LRESULT CALLBACK	About(HWND, UINT, WPARAM, LPARAM);

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
 	// TODO: Place code here.
	MSG msg;
	HACCEL hAccelTable;

	// Initialize global strings
	LoadString(hInstance, IDS_APP_TITLE, szTitle, MAX_LOADSTRING);
	LoadString(hInstance, IDC_DOWIN32TEST, szWindowClass, MAX_LOADSTRING);
	MyRegisterClass(hInstance);

	// Perform application initialization:
	if (!InitInstance (hInstance, nCmdShow)) 
	{
		return FALSE;
	}

	hAccelTable = LoadAccelerators(hInstance, (LPCTSTR)IDC_DOWIN32TEST);

	// Main message loop:
	while (GetMessage(&msg, NULL, 0, 0)) 
	{
		if (!TranslateAccelerator(msg.hwnd, hAccelTable, &msg)) 
		{
			TranslateMessage(&msg);
			DispatchMessage(&msg);
		}
	}

	return msg.wParam;
}



//
//  FUNCTION: MyRegisterClass()
//
//  PURPOSE: Registers the window class.
//
//  COMMENTS:
//
//    This function and its usage is only necessary if you want this code
//    to be compatible with Win32 systems prior to the 'RegisterClassEx'
//    function that was added to Windows 95. It is important to call this function
//    so that the application will get 'well formed' small icons associated
//    with it.
//
ATOM MyRegisterClass(HINSTANCE hInstance)
{
	WNDCLASSEX wcex;

	wcex.cbSize = sizeof(WNDCLASSEX); 

	wcex.style			= CS_HREDRAW | CS_VREDRAW;
	wcex.lpfnWndProc	= (WNDPROC)WndProc;
	wcex.cbClsExtra		= 0;
	wcex.cbWndExtra		= 0;
	wcex.hInstance		= hInstance;
	wcex.hIcon			= LoadIcon(hInstance, (LPCTSTR)IDI_DOWIN32TEST);
	wcex.hCursor		= LoadCursor(NULL, IDC_ARROW);
	wcex.hbrBackground	= (HBRUSH)(COLOR_WINDOW+1);
	wcex.lpszMenuName	= (LPCSTR)IDC_DOWIN32TEST;
	wcex.lpszClassName	= szWindowClass;
	wcex.hIconSm		= LoadIcon(wcex.hInstance, (LPCTSTR)IDI_SMALL);

	return RegisterClassEx(&wcex);
}

//
//   FUNCTION: InitInstance(HANDLE, int)
//
//   PURPOSE: Saves instance handle and creates main window
//
//   COMMENTS:
//
//        In this function, we save the instance handle in a global variable and
//        create and display the main program window.
//
BOOL InitInstance(HINSTANCE hInstance, int nCmdShow)
{
   HWND hWnd;

   hInst = hInstance; // Store instance handle in our global variable

   hWnd = CreateWindow(szWindowClass, szTitle, WS_OVERLAPPEDWINDOW,
      CW_USEDEFAULT, 0, CW_USEDEFAULT, 0, NULL, NULL, hInstance, NULL);

   if (!hWnd)
   {
      return FALSE;
   }

   ShowWindow(hWnd, nCmdShow);
   UpdateWindow(hWnd);

   return TRUE;
}

//
//  FUNCTION: WndProc(HWND, unsigned, WORD, LONG)
//
//  PURPOSE:  Processes messages for the main window.
//
//  WM_COMMAND	- process the application menu
//  WM_PAINT	- Paint the main window
//  WM_DESTROY	- post a quit message and return
//
//
LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
	int wmId, wmEvent;
	PAINTSTRUCT ps;
	HDC hdc;
	TCHAR szHello[MAX_LOADSTRING];
	LoadString(hInst, IDS_HELLO, szHello, MAX_LOADSTRING);

	switch (message) 
	{
		case WM_COMMAND:
			wmId    = LOWORD(wParam); 
			wmEvent = HIWORD(wParam); 
			// Parse the menu selections:
			switch (wmId)
			{
				case IDM_ABOUT:
				   DialogBox(hInst, (LPCTSTR)IDD_ABOUTBOX, hWnd, (DLGPROC)About);
				   break;
				case IDM_EXIT:
				   DestroyWindow(hWnd);
				   break;
				default:
				   return DefWindowProc(hWnd, message, wParam, lParam);
			}
			break;
		case WM_PAINT:
			hdc = BeginPaint(hWnd, &ps);
			// TODO: Add any drawing code here...
			RECT rt;
			GetClientRect(hWnd, &rt);
			DrawText(hdc, szHello, strlen(szHello), &rt, DT_CENTER);
			EndPaint(hWnd, &ps);
			break;
		case WM_DESTROY:
			PostQuitMessage(0);
			break;
		default:
			return DefWindowProc(hWnd, message, wParam, lParam);
   }
   return 0;
}

// Mesage handler for about box.
LRESULT CALLBACK About(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{
	switch (message)
	{
		case WM_INITDIALOG:
				return TRUE;

		case WM_COMMAND:
			if (LOWORD(wParam) == IDOK || LOWORD(wParam) == IDCANCEL) 
			{
				EndDialog(hDlg, LOWORD(wParam));
				return TRUE;
			}
			break;
	}
    return FALSE;
}

　　最后，记得修改所有项目的生成目录，令所有项目生成到一个目录。我设置的方法是直接在默认生成目录前加“..\”。祝你成功。

转载于:https://www.cnblogs.com/xuesongshu/archive/2013/04/04/hookapi.html

weixin_30767921
关注
x64 APIHOOK
04-17
64位系统的apihook类,方便使用apihook,64位asm很麻烦的..
x64 APIHook类
04-17
x64 APIHook类,用在x64位操作系统下的apihook
两步hook获取64位微信（3.9.11.25）好友列表
最新发布
jysatuo的博客
08-29 495
在黄色框中下拉可以看到好友信息完整压入堆栈，点击红色框，在蓝色的汇编代码处写入断点，这个就是要hook的位置，好友信息在寄存器rbp中。附frida代码，后续代码会上传github，另外我们目前在寻找合适的创业项目，有想法的朋友可以沟通交流，后面先拉个共创群，蔚Jysauto1314辛。cheat engine搜索微信好友列表中的微信号，点击不同好友，再次扫描当前好友微信号，直到结果数量减少。添加图片注释，不超过 140 字（可选） 添加图片注释，不超过 140 字（可选）
HOOK API 完美支持 x86 x64
05-24
完美支持 x86、x64 HOOK，有多种选项，x64 下支持 5字节跳转，12字节跳转和14字节跳转，另有内核版本。
64位inline api hook
Reverser的专栏
05-23 1023
说起Api hook朋友们都不陌生，说白了也就是运用WINDOWS系统钩子，捕获程序对系统API的调用，从面改变API默认的处理方式，以达到某种特殊的目的。而inline api hook在32位系统中通常是先保存API函数入口处的5个字节，然后改变API函数入口处的5个字节为一个JMP xx xx xx xx跳转指令，xx xx xx xx处是我们自己的处理函数的偏移地址。在我们的处理函数中，进
64/32 hook api 实现
11-23
原理说明地址 http://www.codeproject.com/KB/winsdk/LibMinHook.aspx
C++使用hookapi操作源代码windows环境
12-28
在HookAPI的实际应用中，常见的例子包括： 1. **网络Hook**：可以拦截网络通信，如HTTP请求，进行数据抓取、日志记录或者安全检查。 2. **注册表Hook**：监视并控制对注册表的访问，可用于跟踪配置更改或防止恶意...
APIHook例子 hook api
06-06
这个例子是关于如何Hook Windows Socket API，即Winsock，来监控或改变网络通信行为。让我们深入探讨APIHook的基本原理以及如何实现对Winsock的Hook。 首先，APIHook的核心思想是在目标函数执行前或执行后插入自己...
WindowsAPI.rar_hook api_visual c_windows api
09-19
windows API书中的一些例子实现
驱动内核模式下的apihook钩子例子，编写驱动程序.zip
03-28
本压缩包包含的资源是关于在驱动内核模式下实现API Hook的例子，这对于理解操作系统内部工作原理、开发安全软件以及进行系统级别的调试非常有价值。 "驱动内核模式下的apihook"指的是在操作系统内核层面对API调用...
apihook钩子程序例子，简单的实现过程，学习用.zip
03-28
API Hook是一种技术，它允许程序员拦截系统调用或者特定函数的调用，以便在调用原函数之前或之后执行自定义代码。这个技术在很多场景下都非常有用，比如调试、日志记录、性能分析，甚至是恶意软件中用来隐藏自身行为...
64位API HOOK汇编源码
05-27
用FASM开发的64位API HOOK程序，对系统注册表进行监控，并保护自身进程不被强行关闭，适用系统：64位WIN7
HOOKAPI——detours_X64库
12-25
64位版本的detours库并附带文档,微软64位 HOOKAPI ，有需要的可以学习，64位HOOK编程
API HOOK 64位 VS2008 可编译
04-22
用于windows 64位工程的 通用API hook 代示例工程
一个比较稳定的API劫持代码APIHookX86X64.rar
09-11
一个比较稳定的API劫持代码APIHookX86X64
C# 优雅的 APIHOOK 支持X86+X64源码
09-21
using System; using System.Runtime.InteropServices; namespace NativeHook.Test { public delegate Int32 MessageBoxW(IntPtr hWnd, [MarshalAs(UnmanagedType.LPWStr)] string lpText, [MarshalAs(UnmanagedType.LPWStr)] string lpCaption, UInt32 uType); public class MessageBoxHook : NtAPIHook { [DllHook("user32", EntryPoint = "MessageBoxW")] public Int32 MessageBox(IntPtr owner, string text, string caption, UInt32 options) { //拦截信息 Console.Title = caption; Console.WriteLine(text); //调用源函数 return Origin.Invoke(owner, text, caption, options); } } } [STAThread] static void Main(string[] args) { using (var hook = new MessageBoxHook()) { //绕过Hook直接调用源函数 hook.Origin(IntPtr.Zero, "111", "222", 0); //调用Api 被Hook MessageBox.Show("Hello world", "666", MessageBoxButtons.YesNoCancel); } //Hook解除拦截不到 MessageBox.Show("Hello world", "666", MessageBoxButtons.YesNoCancel); }
64位系统 inline api hook之我见
梦码工作室
11-12 3459
      说起Api hook朋友们都不陌生，说白了也就是运用WINDOWS系统钩子，捕获程序对系统API的调用，从面改变API默认的处理方式，以达到某种特殊的目的。而inline api hook在32位系统中通常是先保存API函数入口处的5个字节，然后改变API函数入口处的5个字节为一个JMP xxxx跳转指令，xxxx处是我们自己的处理函数的偏移地址。在我们的处理函数中，进行一系列动作，达到我们的目的后，再把所保存的5个字节还原到API函数入口处，然后进行调用，以实现API函数原有的功能。     
win64 内核hook API
不会写代码的丝丽
03-12 739
除了 SSDT hook和Inline hook外，内核还提供其他官方的API方便我们进行hook操作从而完成一些安全软件的研发等。举例其中以下API函数两个函数都是用于注册一个回调监听进程的创建或者退出时调用,不同的是EX后缀函数不仅可以监听而且还可以控制创建的进程结果。参数说明: 回调函数Remove: 如果为TRUE ，从系统回调表中删除回调函数的注册。FALSE为注册函数到回调函数表中。
MinHook - 最小化的 x86/x64 API 钩子库
whatday的专栏
08-03 4967
背景 对windows API钩子感兴趣的人都知道有一个优秀的库被微软命名为'Detours'。它真的很有用，但是它的免费版本（Express）是不支持X64。它的收费版本（Professional）支持x64，但是对我来说太昂贵了。微软说它值一万美元。 因此我决定从零开始写我自己的库。但是我没有将Detours的功能完美的复制到我的库中，它仅有API钩子功能，因为这就是我想要的。
HOOKAPI入门：如何HOOK自己程序的MessageBox
在Windows编程中，HOOKAPI是一种强大的技术，它允许程序员拦截和修改特定API的调用行为。在本文档的"HOOKAPI（二）——HOOK自己程序的MessageBox"部分，作者讲解了一个基础的HOOKAPI应用实例，即替换程序中对...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值