Mobile6.1 API Hook问题

最新推荐文章于 2025-08-19 18:44:33 发布

Elvis_05252010

最新推荐文章于 2025-08-19 18:44:33 发布

阅读量512

点赞数

CC 4.0 BY-SA版权

分类专栏： WinCE 文章标签： hook mobile api byte descriptor header

本文链接：https://blog.youkuaiyun.com/Elvis_05252010/article/details/6163607

WinCE 专栏收录该内容

2 篇文章

订阅专栏

本文探讨了一个关于HookOneAPI函数的问题，在尝试钩住特定API时出现异常。文章详细记录了作者遇到的具体错误，并展示了相关代码片段。作者希望通过调整内存权限解决访问受限的问题。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

void HookOneAPI(LPCTSTR pszCalleeModuleName,PROC pfnOriginApiAddress,PROC pfnDummyFuncAddress,HMODULE hModCallerModule)
{
RETAILMSG(1,(TEXT("--HookOneAPI------1----/n")));

pDosHeader = (PIMAGE_DOS_HEADER)hModCallerModule;
RETAILMSG(1,(TEXT("--HookOneAPI------1--1--/n")));

pNTHeaders = (PIMAGE_NT_HEADERS)((BYTE *)hModCallerModule + pDosHeader->e_lfanew);
RETAILMSG(1,(TEXT("--HookOneAPI------1--2--/n")));
pOptHeader = (PIMAGE_OPTIONAL_HEADER)&(pNTHeaders->OptionalHeader);

RETAILMSG(1,(TEXT("--HookOneAPI------1--3--/n")));
pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((BYTE *)hModCallerModule + pOptHeader->DataDirectory[1].VirtualAddress);

RETAILMSG(1,(TEXT("--HookOneAPI------2----/n")));

while(pImportDescriptor->FirstThunk)
{
char * dllname = (char *)((BYTE *)hModCallerModule + pImportDescriptor->Name);

pThunkData = (PIMAGE_THUNK_DATA)((BYTE *)hModCallerModule + pImportDescriptor->OriginalFirstThunk);

RETAILMSG(1,(TEXT("--HookOneAPI------3----/n")));

  int no = 1;
  while(pThunkData->u1.Function)
  {
   char * funname = (char *)((BYTE *)hModCallerModule + (DWORD)pThunkData->u1.AddressOfData + 2);
   PDWORD lpAddr = (DWORD *)((BYTE *)hModCallerModule + (DWORD)pImportDescriptor->FirstThunk) +(no-1);

   //修改内存的部分
   if((*lpAddr) == (int)pfnOriginApiAddress)
   {
    RETAILMSG(1,(TEXT("--HookOneAPI------4----/n")));

    //修改内存页的属性
    DWORD dwOLD;
    MEMORY_BASIC_INFORMATION mbi;
    VirtualQuery(lpAddr,&mbi,sizeof(mbi));
    VirtualProtect(lpAddr,sizeof(DWORD),PAGE_READWRITE,&dwOLD);

    WriteProcessMemory(GetCurrentProcess(),
      lpAddr, &pfnDummyFuncAddress, sizeof(pfnDummyFuncAddress), NULL);
    //恢复内存页的属性
    VirtualProtect(lpAddr,sizeof(DWORD),dwOLD,0);

    return;
   }
   //---------
   no++;
   pThunkData++;
  }

  pImportDescriptor++;
}
}
DWORD GetProcessAddress(LPCTSTR pName)
{
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (INVALID_HANDLE_VALUE == hSnapshot)
{
  return 0;
}
PROCESSENTRY32 pe = { sizeof(pe) };
BOOL fOk;
for (fOk = Process32First(hSnapshot, &pe); fOk; fOk = Process32Next(hSnapshot, &pe))
{
  if (0 == wcscmp(pe.szExeFile, pName))
  {
   CloseHandle(hSnapshot);
   return pe.th32MemoryBase;
  }
}
CloseHandle(hSnapshot);
return 0;
}

BOOL InstallHook(BOOL IsHook)
{
modeStatus = SetKMode(TRUE);
dwPerm = SetProcPermissions(GetCurrentPermissions());

DWORD currHandle = GetProcessAddress(TEXT("cmdcore.exe"));

HookOneAPI(L"coredll.dll",GetProcAddress(GetModuleHandle(TEXT("coredll.dll")),L"DispatchMessageW"),(PROC)&H_DispatchMessageW,(HMODULE)currHandle/*GetModuleHandle(TEXT("console.dll"))*/);

return TRUE;
}

现在代码执行到

RETAILMSG(1,(TEXT("--HookOneAPI------1--1--/n")));

pNTHeaders = (PIMAGE_NT_HEADERS)((BYTE *)hModCallerModule + pDosHeader->e_lfanew);

会出现异常。

我得到的hModCallerModule值是0x24000000，好像是地址访问受限，我通过SetKMode 和 SetProcPermissions 也没有任何改善。

希望大家能给些建议。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。。