API挂接的一个例子

最新推荐文章于 2023-11-14 15:47:08 发布

原创最新推荐文章于 2023-11-14 15:47:08 发布 · 521 阅读

2 ·

CC 4.0 BY-SA版权

文章标签：

#api #descriptor #import #null #image #dll

本文介绍了一个使用C++实现的DLL函数替换示例。通过修改导入地址表，将一个DLL中的函数替换为另一个函数，实现了从Hello World到Hello JYY的输出变化。示例包括了必要的头文件引入、函数声明及主程序流程。

测试DLL的函数

APIHookDll.dll

void __stdcall PrintfHelloWorld()
{
printf("Hello World");
}

APIHook.exe代码

#include <Windows.h>
//#include <Dbghelp.h>
#include <ImageHlp.h>
#include <WINNT.H>
#include "APIHookDll.h"
#pragma comment(lib, "ImageHlp")

void ReplaceIAEntryInOneMod(const char *pCallModeName, PROC pfnCurrent, PROC pfnReplaceFun, HMODULE hmodCaller)
{
ULONG ulSize = 0;
PIMAGE_IMPORT_DESCRIPTOR pImage = (PIMAGE_IMPORT_DESCRIPTOR) ImageDirectoryEntryToDataEx(hmodCaller, TRUE,
IMAGE_DIRECTORY_ENTRY_IMPORT, &ulSize, NULL);
if (!pImage)
{
return;
}

for (; pImage->Name; pImage++)
{
  char *pFunName = (char *)((PBYTE) hmodCaller + pImage->Name);
  if ( strcmp( pCallModeName, pFunName) == 0 )
  {
   break;
  }
}

if ( NULL == pImage->Name)
{
return;
}

PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA) ( ((PBYTE) hmodCaller) + pImage->FirstThunk );
for (; pThunk->u1.Function; pThunk++)
{
  PROC *pfnExport = (PROC *) &(pThunk->u1.Function);
  BOOL bFound = (*pfnExport == pfnCurrent);
  if (bFound)
  {
   WriteProcessMemory(GetCurrentProcess(), pfnExport, &pfnReplaceFun, sizeof(pfnReplaceFun), NULL);

return;
}
}
}

void PrintfHelloJYY()
{
printf("Hello JYY /r/n");
}

int _tmain(int argc, _TCHAR* argv[])
{

HMODULE hTestModule = GetModuleHandleW(L"APIHook.exe");
PROC fnCurrent = GetProcAddress(GetModuleHandleW(L"APIHookDll.dll"), _T("PrintfHelloWorld"));

if (!hTestModule)
{
return 1;
}
ReplaceIAEntryInOneMod("APIHookDll.dll", fnCurrent, (PROC) PrintfHelloJYY, hTestModule);
PrintfHelloWorld();
(*fnCurrent)();

getchar();
return 0;
}