HOOK-IAT.rar_IAT_iat hook_pe iat_pe 入口点hook_入口点

#include <windows.h> #include <stdio.h> BOOL sethook(HMODULE hMod); BOOL unhook(HMODULE hMod); typedef int(WINAPI *PFNMESSAGEBOX)(HWND,LPCSTR,LPCSTR,UINT uType); PROC g_orgProc=(PROC)MessageBoxA; int WINAPI WinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd ) { sethook(::GetModuleHandle(NULL)); ::MessageBoxA(NULL,"原函数","02",0); unhook(::GetModuleHandle(NULL)); ::MessageBoxA(NULL,"原函数","02",0); return TRUE; } int WINAPI MyMessageBoxA(HWND hWnd,LPCSTR lpText,LPCSTR lpCaption,UINT uType) { //return((PFNMESSAGEBOX)g_orgProc)(hWnd,"新函数","02",uType); return Beep(500,500); } BOOL sethook(HMODULE hMod) { IMAGE_DOS_HEADER *pDosHeader=(IMAGE_DOS_HEADER*)hMod; IMAGE_OPTIONAL_HEADER *pOptHeader=(IMAGE_OPTIONAL_HEADER *)((BYTE *)hMod+pDosHeader->e_lfanew+24); IMAGE_IMPORT_DESCRIPTOR *pImportDesc=(IMAGE_IMPORT_DESCRIPTOR *)((BYTE *)hMod+pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress); while (pImportDesc->FirstThunk) { char * pszDllName =(char *)((BYTE *)hMod+pImportDesc->Name); if (lstrcmpiA(pszDllName,"user32.dll")==0) { break; } pImportDesc++; } if (pImportDesc->FirstThunk) { IMAGE_THUNK_DATA *pThunk=(IMAGE_THUNK_DATA *)((BYTE *)hMod+pImportDesc->FirstThunk); while(pThunk->u1.Function) { DWORD * lpAddr=(DWORD *)&(pThunk->u1.Function); if (*lpAddr==(DWORD)g_orgProc) { DWORD * lpNewProc=(DWORD *)MyMessageBoxA; ::WriteProcessMemory(GetCurrentProcess(),lpAddr,&lpNewProc,sizeof(DWORD),NULL); return TRUE; } pThunk++; } } return FALSE; } BOOL unhook(HMODULE hMod) { IMAGE_DOS_HEADER *pDosHeader=(IMAGE_DOS_HEADER*)hMod; IMAGE_OPTIONAL_HEADER *pOptHeader=(IMAGE_OPTIONAL_HEADER *)((BYTE *)hMod+pDosHeader->e_lfanew+24); IMAGE_IMPORT_DESCRIPTOR *pImportDesc=(IMAGE_IMPORT_DESCRIPTOR *)((BYTE *)hMod+pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress); while (pImportDesc->FirstThunk) { char * pszDllName =(char *)((BYTE *)hMod+pImportDesc->Name); if (lstrcmpiA(pszDllName,"user32.dll")==0) { break; } pImportDesc++; } if (pImportDesc->FirstThunk) { IMAGE_THUNK_DATA *pThunk=(IMAGE_THUNK_DATA *)((BYTE *)hMod+pImportDesc->FirstThunk); while(pThunk->u1.Function) { DWORD * lpAddr=(DWORD *)&(pThunk->u1.Function); if (*lpAddr!=(DWORD)g_orgProc) { ::WriteProcessMemory(GetCurrentProcess(),lpAddr,&g_orgProc,sizeof(DWORD),NULL); return TRUE; } pThunk++; } } return FALSE; }