#include<windows.h>
#include"hookAPIdll.h"
#include <ImageHlp.h>

#pragma data_seg("Shared")
HHOOK      glhHook=NULL;
HINSTANCE  hmodDll=NULL;
#pragma data_seg()
#pragma comment(linker,"/Section:Shared,rws")

LRESULT WINAPI GetMsgProc(int nCode,WPARAM wParam,LPARAM lParam);
void ReplaceIATEntryInOneMod(PCSTR pszCalleeModName,PROC pfnCurrent, PROC pfnNew, HMODULE hmodCaller) ;

int WINAPI DllMain (HINSTANCE hinstDll, DWORD fdwReason, PVOID pvReserved)
        
{
   switch(fdwReason)
   {
       case DLL_PROCESS_ATTACH:

       case DLL_PROCESS_DETACH:
       break;
   }
  hmodDll = hinstDll;     
return TRUE ;        
}
      
EXPORT BOOL CALLBACK  sethook()
{
   glhHook=SetWindowsHookEx(WH_GETMESSAGE,(HOOKPROC)GetMsgProc,hmodDll,0);     
   return 1;
}
//用来替换myTerminateProcess的。
EXPORT BOOL CALLBACK myTerminateProcess( HANDLE hProcess,UINT uExitCode )
{
   hProcess=NULL;
   uExitCode=NULL;
  MessageBox(NULL,"该进程不能被关闭","错误！",0);
return  1;
}

LRESULT WINAPI GetMsgProc(int nCode,WPARAM wParam,LPARAM lParam)
{
HMODULE hmodCaller = GetModuleHandle("behook.exe");//想挂钩这个进程
   ReplaceIATEntryInOneMod("Kernel32.dll",GetProcAddress(GetModuleHandle("Kernel32"),"TerminateProcess"),(PROC)myTerminateProcess,hmodCaller);/*用myTerminateProcess来代替    TerminateProcess*/
    return CallNextHookEx((HHOOK)glhHook,nCode,wParam,lParam);
}

// ReplaceIATEntryInOneMod为改写IAT函数
void ReplaceIATEntryInOneMod(PCSTR pszCalleeModName,
   PROC pfnCurrent, PROC pfnNew, HMODULE hmodCaller)
{
   ULONG ulSize;
   PIMAGE_IMPORT_DESCRIPTOR pImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)
      ImageDirectoryEntryToData(hmodCaller, TRUE,
      IMAGE_DIRECTORY_ENTRY_IMPORT, &ulSize);

   if(pImportDesc == NULL)
      return;  
   for(; pImportDesc->Name; pImportDesc++)
   {
      PSTR pszModName = (PSTR)
        ((PBYTE) hmodCaller + pImportDesc->Name);
      if(lstrcmpiA(pszModName, pszCalleeModName) == 0)
         break;
   }

   if(pImportDesc->Name == 0)
      return;

   PIMAGE_THUNK_DATA pThunk = (PIMAGE_THUNK_DATA)
      ((PBYTE) hmodCaller + pImportDesc->FirstThunk);

  
   for(; pThunk->u1.Function; pThunk++)
   {
      PROC* ppfn = (PROC*) &pThunk->u1.Function;
      BOOL fFound = (*ppfn == pfnCurrent);

      if(fFound)
      {   
         WriteProcessMemory(GetCurrentProcess(), ppfn, &pfnNew,
            sizeof(pfnNew), NULL);
         return;  
      }
   }
}

本想挂钩掉behook.exe调用的 TerminateProcess函数，可是不行不知道那里出错了，请大家帮我改一改。谢谢！

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)