-
-
[旧帖]
[求助]求助一下在HOOK那个API时遇到的困惑
0.00雪花
-
发表于:
2011-3-20 12:51
1395
-
[旧帖] [求助]求助一下在HOOK那个API时遇到的困惑
0.00雪花
#include "windows.h"
#include "stdio.h"
BOOL bMessage = 0;
typedef int (WINAPI *PFNMESSAGEBOX)(HWND,LPCSTR,LPCSTR,UINT);
PROC g_orgAddr = (PROC)MessageBoxA;
int MyMessageBox(HWND hWnd,LPCSTR lpContent,LPCSTR lpTitle,UINT uType);
int main()
{
HMODULE hMod = GetModuleHandle(NULL);
IMAGE_DOS_HEADER* pDosHeader = (IMAGE_DOS_HEADER*)(BYTE*)hMod;
IMAGE_OPTIONAL_HEADER* pOptHeader = (IMAGE_OPTIONAL_HEADER*)(pDosHeader->e_lfanew + 24 + (BYTE*)hMod);
IMAGE_IMPORT_DESCRIPTOR* pImportDesc = (IMAGE_IMPORT_DESCRIPTOR*)((BYTE*)hMod + pOptHeader->DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
while(pImportDesc->FirstThunk)
{
char* pszDllName = (char*)(pImportDesc->Name + (BYTE*)hMod);
printf("Dll Name : %-10s \n",pszDllName);
IMAGE_THUNK_DATA* pThunk = (IMAGE_THUNK_DATA*)((BYTE*)hMod + pImportDesc->OriginalFirstThunk);
while(pThunk->u1.Function)
{
char* pszFuncName = (char*)((DWORD)pThunk->u1.AddressOfData + (BYTE*)hMod + 2);
DWORD* pszFuncAddr = (DWORD*)(pThunk->u1.Function + (BYTE*)hMod);
printf("\t函数名称:%-30s",pszFuncName);
printf("函数地址:%-8x\n",pszFuncAddr);
char* fnName = pszFuncName;
if(strcmp(fnName,"MessageBoxA")==0)
{
bMessage = 1;
DWORD* lpNewAddr = (DWORD*)MyMessageBox;
printf("\t%-39s写新地址:%x \n","",lpNewAddr);
VirtualProtect(pszFuncAddr,sizeof(DWORD),PAGE_READWRITE,NULL);
BOOL bRet = ::WriteProcessMemory(GetCurrentProcess(),pszFuncAddr,lpNewAddr,sizeof(DWORD),NULL);
DWORD* gpNewAddr = NULL;
::ReadProcessMemory(GetCurrentProcess(),pszFuncAddr,gpNewAddr,sizeof(DWORD),NULL);
if(bRet)
puts("\tWriteProcessMemory successfully");
printf("\t函数名称:%-30s",fnName);
printf("函数地址:%x\n",gpNewAddr);
}
pThunk++;
}
pImportDesc++;
}
if(bMessage)
MessageBox(NULL,"当你看到这个，说明没有HOOK成功啊！","失败了！",0);
getchar();
return 0;
}
int WINAPI MyMessageBox(HWND hWnd,LPCSTR lpContent,LPCSTR lpTitle,UINT uType)
{
return ((PFNMESSAGEBOX)g_orgAddr)(hWnd,"原函数退休了，我接管了！",lpTitle,uType);
}
这个代码编译通过了，运行结果有问题：我HOOK掉了MessageBoxA函数，这个结果说WriteProcessMemory是成功了的，但是最后弹出来的还是原来的没有被HOOk的函数！！我用ReadProcessMemory去验证到底写成功了没,结果是没有读出数据，不知道这是怎么回事！！！
请大家帮我看看，小弟先谢谢大家哦
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
