IAT Hook示例

#include "stdafx.h"
//在这个文件中实现IATHook

//这个函数，只Hook exe文件的IAT

typedef int (WINAPI  *MESSAGEBOXW)(
	_In_opt_ HWND hWnd,
	_In_opt_ LPCWSTR lpText,
	_In_opt_ LPCWSTR lpCaption,
	_In_ UINT uType);
MESSAGEBOXW g_MessageBox;



int WINAPI MyMessageBox(
	_In_opt_ HWND hWnd, 
	_In_opt_ LPCWSTR lpText,
	_In_opt_ LPCWSTR lpCaption,
	_In_ UINT uType)
{
	lpText = L"IATHook成功";
	lpCaption = L"哈哈";
	return g_MessageBox(hWnd, lpText, lpCaption, 0);
}



//************************************
// 函数名: OnIATHook
// 说明  ：进行IATHook，只能Hook exe部分
// 参数1：要Hook的Dll名字
// 参数2：要Hook的函数名字
// 返回值:   bool 成功的返回true，失败的话返回false
//************************************

bool OnIATHook(char  * szDllName,char * szFunName,DWORD NewFunAddress,DWORD *OldFunAddress)
{
	OutputDebugStringA("开始进行IAThook");
	// 1找到exe的加载基址
	PBYTE pBuf = (PBYTE)GetModuleHandle(NULL);
	//2 找到导入表
	PIMAGE_DOS_HEADER pDos = (PIMAGE_DOS_HEADER)pBuf;
	PIMAGE_NT_HEADERS pNt = (PIMAGE_NT_HEADERS)(pDos->e_lfanew + pBuf);
	PIMAGE_DATA_DIRECTORY pImportDir = 
		(pNt->OptionalHeader.DataDirectory + 1);
	PIMAGE_IMPORT_DESCRIPTOR pImport =
		(PIMAGE_IMPORT_DESCRIPTOR)(pImportDir->VirtualAddress + pBuf);
	//3 遍历导入表，找到对应的dll
	while (pImport->Name != NULL)
	{
		//dll的名字
		char * szImportDllName = (char*)(pImport->Name + pBuf);
		OutputDebugStringA(szImportDllName);
		if (_stricmp(szImportDllName, szDllName) == 0)//不管大小写比较
		{	
			OutputDebugStringA("开始寻找函数名");
			//找到这个dll了
			//4 在对应dll的导入名称表中，找到我们要Hook的函数，得到位置
			//  先检测一下是单桥结构的导入表还是双桥结构的导入表
			//  本方法不适用于单桥结构的IATHook。
			if (pImport->OriginalFirstThunk == 0)
			{
				return false;
			}
			PIMAGE_THUNK_DATA pInt = (PIMAGE_THUNK_DATA)
				(pImport->OriginalFirstThunk + pBuf);
			PDWORD pIat = 
				(PDWORD)(pImport->FirstThunk + pBuf);
			int nLoc = 0;
			while (pInt->u1.Function!=NULL)
			{
				
				if ((pInt->u1.Ordinal & 0x80000000) != 1)
				{
					OutputDebugStringA("hehe");
					PIMAGE_IMPORT_BY_NAME pName =
						(PIMAGE_IMPORT_BY_NAME)(pInt->u1.AddressOfData + pBuf);
					//5 在对应dll的导入地址表中，进行Hook
					OutputDebugStringA("输出名称之前");
					OutputDebugStringA(pName->Name);
					if (_stricmp(pName->Name, szFunName) == 0)
					{
						DWORD OldProtect = 0;
						//*OldFunAddress = pIat[nLoc];
						OutputDebugStringA("开始修改");
					VirtualProtect(&pIat[nLoc], 4, PAGE_READWRITE, &OldProtect);
						pIat[nLoc] = NewFunAddress;
						VirtualProtect(&pIat[nLoc], 4, OldProtect, &OldProtect);
						OutputDebugStringA("修改完毕");
						return true;
					}
				}
				nLoc++;
				pInt++;
			}
			break;
		}
		pImport++;
	}
	return false;
}


//HMODULE g_hModule = 0;

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
					 )
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		OutputDebugStringA("Hook成功");
		//g_hModule = hModule;
		OnIATHook(
			"user32.dll",
			"MessageBoxW",
			(DWORD)MyMessageBox, 
			(DWORD*)&g_MessageBox
			);
		break;
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}