API挂接的一个例子

最新推荐文章于 2023-11-14 15:47:08 发布

jyytest

最新推荐文章于 2023-11-14 15:47:08 发布

阅读量494

点赞数

文章标签： api descriptor import null image dll

本文链接：https://blog.youkuaiyun.com/jyytest/article/details/4125527

版权

测试DLL的函数

APIHookDll.dll

void __stdcall PrintfHelloWorld()
{
printf("Hello World");
}

APIHook.exe代码

#include <Windows.h>
//#include <Dbghelp.h>
#include <ImageHlp.h>
#include <WINNT.H>
#include "APIHookDll.h"
#pragma comment(lib, "ImageHlp")

void ReplaceIAEntryInOneMod(const char *pCallModeName, PROC pfnCurrent, PROC pfnReplaceFun, HMODULE hmodCaller)
{
ULONG ulSize = 0;
PIMAGE_IMPORT_DESCRIPTOR pImage = (PIMAGE_IMPORT_DESCRIPTOR) ImageDirectoryEntryToDataEx(hmodCaller, TRUE,
IMAGE_DIRECTORY_ENTRY_IMPORT, &ulSize, NULL);
if (!pImage)
{
return;
}

for (; pImage->Name; pImage++)
{
  char *pFunName = (char *)((PBYTE) hmodCaller + pImage->Name);
  if ( strcmp( pCallModeName, pFunName) == 0 )
  {
   break;
  }
}

if ( NULL == pImage->Name)
{
return;
}

PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA) ( ((PBYTE) hmodCaller) + pImage->FirstThunk );
for (; pThunk->u1.Function; pThunk++)
{
  PROC *pfnExport = (PROC *) &(pThunk->u1.Function);
  BOOL bFound = (*pfnExport == pfnCurrent);
  if (bFound)
  {
   WriteProcessMemory(GetCurrentProcess(), pfnExport, &pfnReplaceFun, sizeof(pfnReplaceFun), NULL);

return;
}
}
}

void PrintfHelloJYY()
{
printf("Hello JYY /r/n");
}

int _tmain(int argc, _TCHAR* argv[])
{

HMODULE hTestModule = GetModuleHandleW(L"APIHook.exe");
PROC fnCurrent = GetProcAddress(GetModuleHandleW(L"APIHookDll.dll"), _T("PrintfHelloWorld"));

if (!hTestModule)
{
return 1;
}
ReplaceIAEntryInOneMod("APIHookDll.dll", fnCurrent, (PROC) PrintfHelloJYY, hTestModule);
PrintfHelloWorld();
(*fnCurrent)();

getchar();
return 0;
}