一个简单的HOOK API的DLL

最新推荐文章于 2020-07-27 10:53:54 发布

blessyou312

最新推荐文章于 2020-07-27 10:53:54 发布

阅读量745

点赞数

CC 4.0 BY-SA版权

文章标签： dll hook api winapi descriptor header

本文链接：https://blog.youkuaiyun.com/blessyou312/article/details/1882218

本文介绍了一种在Windows环境下实现API Hook的技术方法，通过修改内存中的导入表来替换目标函数，实现对MessageBoxA函数的功能代理。具体步骤包括获取当前模块句柄、解析PE文件结构并遍历导入表。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

#include "windows.h"
#include "process.h"
#include "tlhelp32.h"
#include "stdio.h"

#pragma comment(lib,"th32.lib")

PIMAGE_DOS_HEADER pDosHeader;
PIMAGE_NT_HEADERS pNTHeaders;
PIMAGE_OPTIONAL_HEADER    pOptHeader;
PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor;
PIMAGE_THUNK_DATA        pThunkData;
PIMAGE_IMPORT_BY_NAME    pImportByName;
HMODULE hMod;

// 定义MessageBoxA函数原型
typedef int (WINAPI *PFNMESSAGEBOX)(HWND, LPCSTR, LPCSTR, UINT uType);
int WINAPI MessageBoxProxy(IN HWND hWnd, IN LPCSTR lpText, IN LPCSTR lpCaption, IN UINT uType);

int * addr = (int *)MessageBoxA;     //保存函数的入口地址
int * myaddr = (int *)MessageBoxProxy;

void ThreadProc(void *param);//线程函数

//---------------------------主函数开始

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved)
{
    if(fdwReason==DLL_PROCESS_ATTACH)
           _beginthread(ThreadProc,0,NULL);

    return TRUE;
}

//结束进程的函数

void ThreadProc(void *param)
{
    //------------hook api----------------
     hMod = GetModuleHandle(NULL);//当前进程空间的模块句柄

     pDosHeader = (PIMAGE_DOS_HEADER)hMod;
     pNTHeaders = (PIMAGE_NT_HEADERS)((BYTE *)hMod + pDosHeader->e_lfanew);
     pOptHeader = (PIMAGE_OPTIONAL_HEADER)&(pNTHeaders->OptionalHeader);
     pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((BYTE *)hMod + pOptHeader->DataDirectory[1].VirtualAddress);

    while(pImportDescriptor->FirstThunk)
    {
          char * dllname = (char *)((BYTE *)hMod + pImportDescriptor->Name);

           pThunkData = (PIMAGE_THUNK_DATA)((BYTE *)hMod + pImportDescriptor->OriginalFirstThunk);

          int no = 1;
          while(pThunkData->u1.Function)
          {
                char * funname = (char *)((BYTE *)hMod + (DWORD)pThunkData->u1.AddressOfData + 2);
                 PDWORD lpAddr = (DWORD *)((BYTE *)hMod + (DWORD)pImportDescriptor->FirstThunk) +(no-1);

                //修改内存的部分
                if((*lpAddr) == (int)addr)
                {
                    //修改内存页的属性
                     DWORD dwOLD;
                     MEMORY_BASIC_INFORMATION mbi;
                    VirtualQuery(lpAddr,&mbi,sizeof(mbi));
                    VirtualProtect(lpAddr,sizeof(DWORD),PAGE_READWRITE,&dwOLD);

                    WriteProcessMemory(GetCurrentProcess(),
                                 lpAddr, &myaddr, sizeof(DWORD), NULL);
                    //恢复内存页的属性
                    VirtualProtect(lpAddr,sizeof(DWORD),dwOLD,0);
                }
                 no++;
                 pThunkData++;
          }

           pImportDescriptor++;
    }
}

//自己定义的方法
int WINAPI MessageBoxProxy(IN HWND hWnd, IN LPCSTR lpText, IN LPCSTR lpCaption, IN UINT uType)
{
    return       ((PFNMESSAGEBOX)addr)(NULL, "gxter_test", "gxter_title", 0);
    //可以写代码进程其它操作
}