封装delphi Hook Api

最新推荐文章于 2024-03-31 09:46:57 发布

Rzhghost

最新推荐文章于 2024-03-31 09:46:57 发布

阅读量3.3k

点赞数

CC 4.0 BY-SA版权

分类专栏： Delphi 文章标签： delphi hook api destructor constructor function

本文链接：https://blog.youkuaiyun.com/Rzhghost/article/details/2154338

Delphi 专栏收录该内容

18 篇文章

订阅专栏

本文介绍了一种在Windows环境下实现API Hook的技术方案，通过修改内存中的指令指针来替换原有的API函数，从而达到拦截和替换调用的效果。该技术利用了虚拟内存保护机制，并通过临界区确保线程安全。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

直接看代码

unit uApiHook;

interface

uses
  SysUtils, Windows, TlHelp32;

type
  PJmpCode = ^TJmpCode;
  TJmpCode = packed record
JmpCode: BYTE;
Address: Pointer;
MovEAX: Array [0..2] of BYTE;
  end;

type
  TApiHookInfo = class
  private
FCS:TRTLCriticalSection;
FJmpCode: PJmpCode;
FOldProc: PJmpCode;
FLoadLib: Boolean;
FDllHandle: THandle;
FHookFun: Pointer;
m_hProc: DWORD;
FOldPoint: Cardinal;
FbHook: Boolean;
procedure SetPageWrite;
procedure SetPageReadOnly;
  public
FAddr: Pointer;
constructor Create;
destructor Destroy; override;
function init(ADllName, AFunName: string; ANewFunPointer: Pointer):Boolean;
procedure Lock;
procedure UnLock;
procedure Hook;
procedure UnHook;
  end;

implementation

{ TApiHookInfo }

procedure TApiHookInfo.SetPageWrite;
begin
  if Win32PlatForm = VER_PLATFORM_WIN32_NT  then //判断是不是NT.
VirtualProtect(FAddr, $F, PAGE_EXECUTE_READWRITE, FOldPoint);
end;

procedure TApiHookInfo.SetPageReadOnly;
begin
  if Win32PlatForm = VER_PLATFORM_WIN32_NT  then //判断是不是NT.
VirtualProtect(FAddr, $F, FOldPoint, FOldPoint);
end;

constructor TApiHookInfo.Create;
begin
  InitializeCriticalSection(FCS);
  New(FJmpCode);
  New(FOldProc);
  FLoadLib := False;
  FDllHandle := 0;
  FHookFun := nil;
  FbHook := False;
end;

destructor TApiHookInfo.Destroy;
begin
  if FbHook then
UnHook;
  if FLoadLib then
FreeLibrary(FDllHandle);
  Dispose(FJmpCode);
  Dispose(FOldProc);
  DeleteCriticalSection(FCS);
  inherited;
end;

procedure TApiHookInfo.Hook;
var
  dwSize: Cardinal;
begin
  SetPageWrite;
  WriteProcessMemory(m_hProc, FAddr, FJmpCode, 8, dwSize);
  FbHook := True;
  SetPageReadOnly;
end;

function TApiHookInfo.init(ADllName, AFunName: string;
  ANewFunPointer: Pointer):Boolean;
var
  dwSize: DWORD;
begin
FDllHandle := GetModuleHandle(PChar(ADllName));
if FDllHandle = 0 then
  begin
FDllHandle := LoadLibrary(PChar(ADllName));
if FDllHandle = 0 then
begin
Result := False;
   Exit;
end
else
FLoadLib := True;
  end;
  //函数地址
FAddr := GetProcAddress(FDllHandle, PChar(AFunName));
if (FAddr = nil) then
  begin
Result := False;
Exit;
  end;
  //当前进程
m_hProc := GetCurrentProcess();

if (m_hProc = 0) then
  begin
Result := False;
Exit;
  end;
  //读当前进程中函数地址
  SetPageWrite;
  FJmpCode^.JmpCode := $B8;
  FJmpCode^.MovEAX[0] := $FF;
  FJmpCode^.MovEAX[1] := $E0;
  FJmpCode^.MovEAX[2] := 0;
  ReadProcessMemory(m_hProc, FAddr, FOldProc, 8, dwSize);
  FJmpCode^.Address := ANewFunPointer;
  WriteProcessMemory(m_hProc, FAddr, FJmpCode, 8, dwSize);
  SetPageReadOnly;
  Result := True;
end;

procedure TApiHookInfo.Lock;
begin
  EnterCriticalSection(FCS);
end;

procedure TApiHookInfo.UnHook;
var
  dwSize: DWORD;
begin
  SetPageWrite;
  WriteProcessMemory(m_hProc, FAddr, FOldProc, 8, dwSize);
  FbHook := False;
  SetPageReadOnly;
end;

procedure TApiHookInfo.UnLock;
begin
  LeaveCriticalSection(FCS);
end;

end.

使用方法：
var
  g_OpenProcess: TApiHookInfo;

function MyOpenProcess(dwDesiredAccess: DWORD; bInheritHandle: BOOL; dwProcessId: DWORD): THandle; stdcall;
begin
  g_OpenProcess.Lock;
  try
g_OpenProcess.UnHook;
try
   //你自己的一些代码
   Result := OpenProcess(dwDesiredAccess, bInheritHandle, dwProcessId);
   //你自己的一些代码
finally
   g_OpenProcess.Hook;
end;
  finally
g_OpenProcess.UnLock;
  end;
end;

procedure HookApi;
begin
  g_OpenProcess.init('kernel32.dll', 'OpenProcess', @MyOpenProcess);
end;

procedure UnHookAPI;
begin
  g_OpenProcess.Free;
end;