#include "stdafx.h"
#include "detours.h"
#include <stdio.h>
#pragma comment(lib, "detours.lib")
WCHAR s_wzDllPath[256];
char s_szDllPath[256]; 
extern "C"
...{
DETOUR_TRAMPOLINE(BOOL WINAPI Real_CreateProcessW(
LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation), CreateProcessW);
DETOUR_TRAMPOLINE(BOOL WINAPI Real_CreateProcessA(
LPCTSTR lpApplicationName,
LPTSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCTSTR lpCurrentDirectory,
LPSTARTUPINFO lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation), CreateProcessA);

}

BOOL WINAPI Call_CreateProcessW(
LPCWSTR lpApplicationName,
LPWSTR lpCommandLine,
LPSECURITY_ATTRIBUTES lpProcessAttributes,
LPSECURITY_ATTRIBUTES lpThreadAttributes,
BOOL bInheritHandles,
DWORD dwCreationFlags,
LPVOID lpEnvironment,
LPCWSTR lpCurrentDirectory,
LPSTARTUPINFOW lpStartupInfo,
LPPROCESS_INFORMATION lpProcessInformation)
...{
BOOL rv = 0;
WCHAR msgtxt[300];
memset(msgtxt, '
本文介绍了一种利用Detours库Hook Windows API函数CreateProcess的方法,通过修改CreateProcessA和CreateProcessW函数的行为来实现进程创建过程中的自定义逻辑。
1万+





