hook code

// ImageImportDesc.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <Windows.h>
#include <iostream>
#include <string>
#include <DbgHelp.h>

#pragma comment(lib,"Dbghelp.lib")

using namespace std;

typedef VOID (WINAPI* pfnExitProcess)(__in UINT uExitCode);

void ReplaceIATEntryInOneMod(PCSTR pszCalleeModName,pfnExitProcess pfnCurrent,pfnExitProcess pfnNew,HMODULE hmodCaller)
{
	PIMAGE_IMPORT_DESCRIPTOR pImportDesc = NULL; 

	ULONG ulSize;
	pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(hmodCaller,TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT,&ulSize);

	if (pImportDesc == NULL)
	{
		cout<<"ImageDirectoryEntryToData return NULL"<<endl;
		return;
	}

	for (;pImportDesc->Name;pImportDesc++)
	{
		PSTR pszModName = (PSTR)((PBYTE)hmodCaller + pImportDesc->Name);
		cout<<pszModName<<endl;

		if (lstrcmpiA(pszCalleeModName,pszModName) == 0)
		{
			cout<<"OK,Find!"<<endl;
			PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)((PBYTE)hmodCaller+pImportDesc->FirstThunk);

			for (;pThunk->u1.Function;pThunk++)
			{
				pfnExitProcess* ppfn = (pfnExitProcess*)&pThunk->u1.Function;
				BOOL bFound = (*ppfn == pfnCurrent);
				if (bFound)
				{
					if (!WriteProcessMemory(GetCurrentProcess(),ppfn,&pfnNew,sizeof(pfnNew),NULL) 
						&& (ERROR_NOACCESS == GetLastError()))
					{
						DWORD dwOldProtect;
						if (VirtualProtect(ppfn,sizeof(pfnNew),PAGE_WRITECOPY,&dwOldProtect))
						{
							WriteProcessMemory(GetCurrentProcess(),ppfn,&pfnNew,sizeof(pfnNew),NULL);
							VirtualProtect(ppfn,sizeof(pfnNew),dwOldProtect,&dwOldProtect);
						}
					}
				}
			}
		}
	}
}



void WINAPI MyExitProcess(UINT exitCode)
{
	cout<<"My Exit Process"<<endl;
	ExitProcess(0);
	return;
}

int _tmain(int argc, _TCHAR* argv[])
{
	HMODULE hModule = GetModuleHandle(NULL);
	pfnExitProcess pfnOrig = (pfnExitProcess)GetProcAddress(GetModuleHandle(L"Kernel32"),"ExitProcess");
	ReplaceIATEntryInOneMod("Kernel32.dll",pfnOrig,MyExitProcess,hModule);
	ExitProcess(9);
	return 0;
}