修改函数代码HOOK的封装

最新推荐文章于 2023-03-28 13:21:39 发布

最新推荐文章于 2023-03-28 13:21:39 发布 · 163 阅读

文章标签：

#java

本文介绍了一种自定义函数挂钩与解除的技术，包括类初始化时对函数的HOOK操作，以及取消挂钩和重新挂钩的方法。

对外的接口：

1. 类初始化时对函数HOOK

2. //取消挂钩
void UnHook();
3. //重新挂钩
void ReHook();

在初始化时HOOK的代码：

*(DWORD*)(m_btNewBytes+1) = (DWORD)pfnHook;

8个字节的代码地址0xB8, 0x00, 0x00,0x40,0x00,0xFF,0xE0,0x00 只要把第二位和第三位成的数据改成函数的地址，调用原先的函数时就会调到自定义的函数执行...

#ifndef  _ULHOOK_H__
#define _ULHOOK_H__

#include <Windows.h>
#pragma once
class CULHook
{
public:
	CULHook(LPSTR lpszModName, LPSTR lpszFuncNme, PROC pfnHook);
	~CULHook(void);

	//取消挂钩
	void UnHook();
	//重新挂钩
	void ReHook();
protected:
	PROC m_pfnOrig;
	BYTE m_btNewBytes[8];
	BYTE m_btOldBytes[8];
	HMODULE m_hModule;
};


#endif

.cpp

#include "ULHook.h"


CULHook::CULHook(LPSTR lpszModName, LPSTR lpszFuncNme, PROC pfnHook)
{
	BYTE btNewBytes[] = {0xB8, 0x00, 0x00,0x40,0x00,0xFF,0xE0,0x00};
	memcpy(m_btNewBytes, btNewBytes, 8);
	*(DWORD*)(m_btNewBytes+1) = (DWORD)pfnHook;

	m_hModule = ::LoadLibraryA(lpszModName);
	if (NULL == m_hModule)
	{
		m_pfnOrig = NULL;
		return;
	}
	m_pfnOrig = (PROC)::GetProcAddress(m_hModule, lpszFuncNme);
	if (NULL != m_pfnOrig)
	{
		MEMORY_BASIC_INFORMATION mbi = {0};
		DWORD dwOldProtect;
		::VirtualQuery(m_pfnOrig, &mbi, sizeof(mbi));
		::VirtualProtect(m_pfnOrig, 8, PAGE_READWRITE, &dwOldProtect);
		memcpy(m_btOldBytes, m_pfnOrig, 8);
		::WriteProcessMemory(GetCurrentProcess(), (VOID*)m_pfnOrig, m_btNewBytes, 8, NULL);
		::VirtualProtect(m_pfnOrig, 8, dwOldProtect, NULL);
	}
}


CULHook::~CULHook(void)
{
	UnHook();
	if (m_hModule!=NULL)
	{
		::FreeLibrary(m_hModule);
	}
}
void CULHook::UnHook()
{
	if (m_pfnOrig != NULL)
	{
		MEMORY_BASIC_INFORMATION mbi = {0};
		DWORD dwOldProtect;
		::VirtualQuery(m_pfnOrig, &mbi, sizeof(mbi));
		::VirtualProtect(m_pfnOrig, 8, PAGE_READWRITE, &dwOldProtect);
		::WriteProcessMemory(GetCurrentProcess(), (VOID*)m_pfnOrig, m_btOldBytes, 8, NULL);
		::VirtualProtect(m_pfnOrig, 8, dwOldProtect, NULL);
	}
}

void CULHook::ReHook()
{
	if (m_pfnOrig != NULL)
	{
		MEMORY_BASIC_INFORMATION mbi = {0};
		DWORD dwOldProtect;
		::VirtualQuery(m_pfnOrig, &mbi, sizeof(mbi));
		::VirtualProtect(m_pfnOrig, 8, PAGE_READWRITE, &dwOldProtect);
		::WriteProcessMemory(GetCurrentProcess(), (VOID*)m_pfnOrig, m_btNewBytes, 8, NULL);
		::VirtualProtect(m_pfnOrig, 8, dwOldProtect, NULL);
	}
}