hook iat改变Messagebox

注意：

1. 定义原始函数类型的写法

//定义函数原型
typedef int (WINAPI *PFNMESSAGEBOX)(HWND hWnd,  LPCTSTR lpText,  LPCTSTR lpCaption,  UINT uType);
//保存原始的MessageBox地址,注意这里
PROC g_orgProc = (PROC)MessageBox;

2. 先找到dll，找到后设置标志

	if (stricmp(pszDllName, "user32.dll") == 0)//如果是user32.dll
		{
			bFindDll = TRUE;
			break;
		}

3. 找到dll后，查找函数名称

//在这里是比较的函数名称
			if (stricmp(pszFuncName, "MessageBoxA") == 0)
			{
				//取得函数地址
				PDWORD lpAddr = (DWORD*)((BYTE*)hModule + pImportDesc->FirstThunk) + n; //从第一个函数的地址，以后每次+4字节
				//在这里是比较的函数地址
				printf("addrss:%X\n", lpAddr);
				DWORD* lpNewProc = (DWORD*)MyMessageBox;
				::WriteProcessMemory(GetCurrentProcess(), lpAddr, &lpNewProc, sizeof(DWORD), NULL);
				return;
			}			

当然 在3.中，也可以根据函数地址比较

#include <windows.h>
#include <stdio.h>

//定义函数原型
typedef int (WINAPI *PFNMESSAGEBOX)(HWND hWnd,  LPCTSTR lpText,  LPCTSTR lpCaption,  UINT uType);
//保存原始的MessageBox地址,注意这里
PROC g_orgProc = (PROC)MessageBox;

int MyMessageBox(HWND hWnd,  LPCTSTR lpText,  LPCTSTR lpCaption,  UINT uType)
{
	return ((PFNMESSAGEBOX)g_orgProc)(hWnd, "mymessagebox", lpCaption, uType);
}

void SetHook()
{
	HMODULE hModule = ::GetModuleHandleA(NULL);
	IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)hModule;
	IMAGE_OPTIONAL_HEADER* pOpNtHeader = (IMAGE_OPTIONAL_HEADER*)((BYTE*)hModule + pDosHeader->e_lfanew + 24); //这里加24
	IMAGE_IMPORT_DESCRIPTOR* pImportDesc = (IMAGE_IMPORT_DESCRIPTOR*)((BYTE*)hModule + pOpNtHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);

	BOOL bFindDll = FALSE;
	while (pImportDesc->FirstThunk)
	{
		char* pszDllName = (char*)((BYTE*)hModule + pImportDesc->Name);
		printf("模块名称:%s\n", pszDllName);
		
		if (stricmp(pszDllName, "user32.dll") == 0)//如果是user32.dll
		{
			bFindDll = TRUE;
			break;
		}
		pImportDesc++;	
	}

	if (bFindDll)
	{
		DWORD n = 0;
		//一个IMAGE_THUNK_DATA就是一个导入函数
		IMAGE_THUNK_DATA* pThunk = (IMAGE_THUNK_DATA*)((BYTE*)hModule + pImportDesc->OriginalFirstThunk);
		while (pThunk->u1.Function)
		{
			//取得函数名称
			char* pszFuncName = (char*)((BYTE*)hModule+pThunk->u1.AddressOfData+2); //函数名前面有两个..
			printf("function name:%-25s,  ", pszFuncName);
			//在这里是比较的函数名称
			if (stricmp(pszFuncName, "MessageBoxA") == 0)
			{
				//取得函数地址
				PDWORD lpAddr = (DWORD*)((BYTE*)hModule + pImportDesc->FirstThunk) + n; //从第一个函数的地址，以后每次+4字节
				//在这里是比较的函数地址
				printf("addrss:%X\n", lpAddr);
				DWORD* lpNewProc = (DWORD*)MyMessageBox;
				::WriteProcessMemory(GetCurrentProcess(), lpAddr, &lpNewProc, sizeof(DWORD), NULL);
				return;
			}			
			n++; //每次增加一个DWORD
		}
		printf("\n");		
	}
	
}
int main(int argc, char* argv[])
{
	::MessageBoxA(NULL, "before hook", "", MB_OK);
	SetHook();
	::MessageBoxA(NULL, "AFTERE hook", "", MB_OK);
	return 0;
}

下面这个是比较函数地址的版本

#include <windows.h>
#include <stdio.h>

//定义函数原型
typedef int (WINAPI *PFNMESSAGEBOX)(HWND hWnd,  LPCTSTR lpText,  LPCTSTR lpCaption,  UINT uType);
//保存原始的MessageBox地址,注意这里
PROC g_orgProc = (PROC)MessageBox;

int MyMessageBox(HWND hWnd,  LPCTSTR lpText,  LPCTSTR lpCaption,  UINT uType)
{
	return ((PFNMESSAGEBOX)g_orgProc)(hWnd, "mymessagebox", lpCaption, uType);
}

void SetHook()
{
	HMODULE hModule = ::GetModuleHandleA(NULL);
	IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)hModule;
	IMAGE_OPTIONAL_HEADER* pOpNtHeader = (IMAGE_OPTIONAL_HEADER*)((BYTE*)hModule + pDosHeader->e_lfanew + 24); //这里加24
	IMAGE_IMPORT_DESCRIPTOR* pImportDesc = (IMAGE_IMPORT_DESCRIPTOR*)((BYTE*)hModule + pOpNtHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);

	BOOL bFindDll = FALSE;
	while (pImportDesc->FirstThunk)
	{
		char* pszDllName = (char*)((BYTE*)hModule + pImportDesc->Name);
		printf("模块名称:%s\n", pszDllName);
		
		if (stricmp(pszDllName, "user32.dll") == 0)//如果是user32.dll
		{
			bFindDll = TRUE;
			break;
		}
		pImportDesc++;	
	}

	if (bFindDll)
	{
		DWORD n = 0;
		//一个IMAGE_THUNK_DATA就是一个导入函数
		IMAGE_THUNK_DATA* pThunk = (IMAGE_THUNK_DATA*)((BYTE*)hModule + pImportDesc->OriginalFirstThunk);
		while (pThunk->u1.Function)
		{
			//取得函数名称
			char* pszFuncName = (char*)((BYTE*)hModule+pThunk->u1.AddressOfData+2); //函数名前面有两个..
			printf("function name:%-25s,  ", pszFuncName);
			//取得函数地址
			PDWORD lpAddr = (DWORD*)((BYTE*)hModule + pImportDesc->FirstThunk) + n; //从第一个函数的地址，以后每次+4字节
			printf("addrss:%X\n", lpAddr);
			//在这里是比较的函数地址
			if (*lpAddr == (DWORD)g_orgProc)
			{								
				DWORD* lpNewProc = (DWORD*)MyMessageBox;
				::WriteProcessMemory(GetCurrentProcess(), lpAddr, &lpNewProc, sizeof(DWORD), NULL);
				return;
			}			
			n++; //每次增加一个DWORD
		}
		printf("\n");		
	}
	
}
int main(int argc, char* argv[])
{
	::MessageBoxA(NULL, "before hook", "", MB_OK);
	SetHook();
	::MessageBoxA(NULL, "AFTERE hook", "", MB_OK);
	return 0;
}

附上修改内存页保护属性的代码：

				//修改内存页的保护属性
				::VirtualQuery(lpAddr, &mbi, sizeof(MEMORY_BASIC_INFORMATION));
				::VirtualProtect(lpAddr, sizeof(DWORD), PAGE_READWRITE, &dwOldProtect);
				::WriteProcessMemory(GetCurrentProcess(), lpAddr, &lpNewProc, sizeof(DWORD), NULL);
				::VirtualProtect(lpAddr, sizeof(DWORD), dwOldProtect, NULL);