笔记，非专业，只为自己看得懂，用语不专业。

API HOOK

HOOK 5字节。

新地址-老地址-5= HEX，     HEX是倒过来显示的。    

比如

00411082 > /E9 590B0000 JMP 00411BE0

 0B59

 

直接上代码。

// HookTest.cpp : 定义控制台应用程序的入口点。//#include "stdafx.h"int MyMessageBoxA(                  HWND hWdn,                  LPCTSTR lpText,                  LPCTSTR lpCaption,                  UINT uType){    char *txt="";    _asm    {        RETN 2;    }    //Sleep();    return 0;}//ULONG OldFunAddr;void My_Hook(ULONG OldFunAddr,ULONG NewFunAddr,int CodeLen);ULONG My_GetApiAddress(char *lpDllName,char *lpFunName);int _tmain(int argc, _TCHAR* argv[]){    char *dllName="user32.dll";    char *lpfunName="MessageBoxA";        ULONG NewFuncAddr=(ULONG)MyMessageBoxA;    MessageBoxA(NULL,"坐等HOOK","坐等HOOK title ",MB_YESNO);    ULONG     OldFunAddr=My_GetApiAddress(dllName,lpfunName);    if (OldFunAddr==NULL)    {        return NULL;    }    My_Hook(OldFunAddr,NewFuncAddr,5);    MessageBoxA(NULL,"关闭句柄","坐等HOOK title ",MB_YESNO);    //printf("1");    //return 0;}BYTE hook_code[5] = {
   0xe9, 0, 0, 0, 0};//存放跳转到MyMessageBoxA的HEXBYTE jmp_org_code[5] = {
   0xe9, 0, 0, 0, 0};//存放跳转到原起始地址后5字节的指令BYTE m_lpJmpCode[5]={
   0x90,0x90,0x90,0x90,0x90};void My_Hook(ULONG OldFunAddr,ULONG NewFunAddr,int CodeLen){    //if (IsBadReadPtr((void *)OldFunAddr,CodeLen))    //{    //}        BYTE JmpMyCode[5]={
   0};    ULONG m_oldFunAddr=OldFunAddr;    ULONG m_NewFunAddr=NewFunAddr;    INT m_CodeLen=CodeLen;        DWORD lpflOldProtect =NULL;     HANDLE hprocss=GetCurrentProcess();    VirtualProtectEx(hprocss,(LPVOID )m_oldFunAddr,5,PAGE_EXECUTE_READWRITE,&lpflOldProtect); //旧地址        *((ULONG*)(hook_code+1))=m_NewFunAddr-m_oldFunAddr-5;//计算HEX 地址。    memcpy((LPVOID)m_oldFunAddr,hook_code,5);//用无类型指针 把 HEX拷贝过去。    VirtualProtectEx(hprocss,(LPVOID)m_oldFunAddr,5,lpflOldProtect,&lpflOldProtect);//修改回来。    CloseHandle(hprocss);}ULONG My_GetApiAddress(char *lpDllName,char *lpFunName){    FARPROC fun;    HMODULE dll;    UINT m_oldFunAdd;    dll =GetModuleHandleA(lpDllName);//获取DLL 模块句柄    if (dll==0)    {        dll=LoadLibraryA(lpDllName);        printf("LoadLibraryA \r\n");    }    if (dll==0)    {        return NULL;    }    fun=GetProcAddress(dll,lpFunName);    m_oldFunAdd=(ULONG)fun;    printf("GetProcAddress \r\n");    printf("%s     Address:%d \r\n",lpFunName,m_oldFunAdd);        return m_oldFunAdd;}

刚开始学习C++ 语法方面很不熟悉。

 

然后