windows核心编程之API拦截

最新推荐文章于 2016-01-29 14:51:46 发布

眼看前方_脚踏实地

最新推荐文章于 2016-01-29 14:51:46 发布

阅读量1.2k

点赞数

分类专栏： windows 核心编程读书笔记文章标签： windows 核心编程 API

本文链接：https://blog.youkuaiyun.com/allen_windows/article/details/9799659

版权

windows 核心编程读书笔记专栏收录该内容

22 篇文章

订阅专栏

本文探讨了Windows核心编程中的一种技术——API拦截，通过替换进程中的API来实现特定功能。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

这个是替换自己进程的API

static void WINAPI MySleep(int i)
{
	//((MyTest)g_sleep)(i);

	MessageBoxA(NULL, "1","1",MB_OK);
}
void MyHook()
{
	PSTR pszKernel		= "kernel32.dll";
	PSTR pszSleepName	= "Sleep";
	PSTR pszMessageBoxA = "MessageBoxA";
	PSTR pszUser32		= "user32.dll";


	HMODULE hExeMod		= GetModuleHandle(NULL);
	HMODULE hKernelMod	= GetModuleHandleA(pszKernel);
	HMODULE hUser32		= GetModuleHandleA(pszUser32);

	PROC pfnNew = (PROC)MySleep;
	PROC pfnOld = g_sleep = GetProcAddress(hKernelMod, pszSleepName);

	ULONG ulsize;

	PIMAGE_IMPORT_DESCRIPTOR pImportDesc = 
		(PIMAGE_IMPORT_DESCRIPTOR)ImageDirectoryEntryToData(
		hExeMod,TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT,&ulsize);

	while(pImportDesc->Name)
	{
		PSTR pszModName = 
			(PSTR)((PBYTE)hExeMod + pImportDesc->Name);
		if (strlen(pszModName) != 0)
		{
			PIMAGE_THUNK_DATA pThunk = 
				(PIMAGE_THUNK_DATA)((PBYTE)hExeMod + pImportDesc->FirstThunk);

			while (pThunk->u1.Function)
			{
				PROC* ppFn =(PROC*)&pThunk->u1.Function;

				if(*ppFn == pfnOld)
				{
					MEMORY_BASIC_INFORMATION mbi;
					VirtualQuery(ppFn,
						&mbi,sizeof(mbi));

					VirtualProtect(
						mbi.BaseAddress,
						mbi.RegionSize,
						PAGE_READWRITE,
						&mbi.Protect);
					*ppFn = pfnNew;
					DWORD dwOldProtect;
					VirtualProtect(
						mbi.BaseAddress,
						mbi.RegionSize,
						mbi.Protect,
						&dwOldProtect);

					break;
				}
				pThunk++;
			}
		}
		pImportDesc++;
	}
}