python hook禁止结束进程_HOOK API（四）—— 进程防终止

//MonitorDll.cpp : 定义 DLL 的初始化例程。//#include"stdafx.h"#include"MonitorDll.h"#ifdef _DEBUG#define new DEBUG_NEW

#endif

/*全局变量*/

//共享变量

#pragma data_seg("Share")HWND g_hwnd= NULL; //主窗口句柄，加载HOOK时传入HINSTANCE hInstance= NULL; //本DLL的实例句柄HHOOK hhook= NULL; //鼠标钩子句柄DWORD g_dwProcessId;//进程idHANDLE g_hProcess= NULL; //保存本进程在远进程中的句柄

#pragma data_seg()

#pragma comment(linker,"/section:Share,rws")

//其他变量定义HANDLE hProcess= NULL; //当前进程句柄

bool bIsInjected = false; //保证只注入一次

#define CODE_LENGTH 5 //入口指令长度

//TerminateProcesstypedef BOOL (WINAPI*TypeTerminateProcess)(_In_ HANDLE hProcess, _In_ UINT uExitCode); //Kernel32.dllTypeTerminateProcess oldTerminateProcess=NULL;

FARPROC pfOldTerminateProcess=NULL;

BOOL WINAPI MyTerminateProcess(_In_ HANDLE hProcess, _In_ UINT uExitCode);

BYTE oldCodeTermPro[CODE_LENGTH];//原API入口BYTE newCodeTermpro[CODE_LENGTH];//新API入口//OpenProcesstypedef HANDLE(WINAPI*TypeOpenProcess)( _In_ DWORD dwDesiredAccess,_In_ BOOL bInheritHandle,_In_ DWORD dwProcessId);

TypeOpenProcess oldOpenProcess=NULL;

FARPROC pfOldOpenProcess=NULL;

HANDLE WINAPI MyOpenProcess(_In_ DWORD dwDesiredAccess,_In_ BOOL bInheritHandle,_In_ DWORD dwProcessId);

BYTE oldCodeOpenPro[CODE_LENGTH];

BYTE newCodeOpenPro[CODE_LENGTH];

BOOL WINAPI HookLoad(HWND hwnd,DWORD dwProcessId);//关于dll hook 操作VOID WINAPI HookUnload();

VOID Inject();

VOID HookOn();

VOID HookOff();

BOOL SetPrivilege(

HANDLE hToken,//access token handleLPCTSTR lpszPrivilege,//name of privilege to enable/disableBOOL bEnablePrivilege//to enable or disable privilege) ;

LRESULT CALLBACK MouseProc(//鼠标钩子子过程调用

int nCode, //hook codeWPARAM wParam,//message identifierLPARAM lParam//mouse coordinates);

BOOL WriteMemory(LPVOID lpAddress,BYTE* pcode,size_t length); //将长度为 length 的 pcode 写入地址 lpAddress 的进程内存中//

//TODO: 如果此 DLL 相对于 MFC DLL 是动态链接的，//则从此 DLL 导出的任何调入//MFC 的函数必须将 AFX_MANAGE_STATE 宏添加到//该函数的最前面。//

//例如://

//extern "C" BOOL PASCAL EXPORT ExportedFunction()//{//AFX_MANAGE_STATE(AfxGetStaticModuleState());