一個簡單的HOOK API的DLL

#include "windows.h"
#include "process.h"
#include "tlhelp32.h"
#include "stdio.h"

#pragma comment(lib,"th32.lib")

PIMAGE_DOS_HEADER pDosHeader;
PIMAGE_NT_HEADERS pNTHeaders;
PIMAGE_OPTIONAL_HEADER    pOptHeader;
PIMAGE_IMPORT_DESCRIPTOR pImportDescriptor;
PIMAGE_THUNK_DATA        pThunkData;
PIMAGE_IMPORT_BY_NAME    pImportByName;
HMODULE hMod;


// 定義MessageBoxA函數原型
typedef int (WINAPI *PFNMESSAGEBOX)(HWND, LPCSTR, LPCSTR, UINT uType);
int WINAPI MessageBoxProxy(IN HWND hWnd, IN LPCSTR lpText, IN LPCSTR lpCaption, IN UINT uType);

int * addr = (int *)MessageBoxA;     //保存函數的入口地址
int * myaddr = (int *)MessageBoxProxy;


void ThreadProc(void *param);//線程函數

//---------------------------主函數開始

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved)
{
    if(fdwReason==DLL_PROCESS_ATTACH)     
           _beginthread(ThreadProc,0,NULL);     

    return TRUE;
}


//結束進程的函數

void ThreadProc(void *param)
{
    //------------hook api----------------
     hMod = GetModuleHandle(NULL);//當前進程空間的模塊句柄

     pDosHeader = (PIMAGE_DOS_HEADER)hMod;
     pNTHeaders = (PIMAGE_NT_HEADERS)((BYTE *)hMod + pDosHeader->e_lfanew);
     pOptHeader = (PIMAGE_OPTIONAL_HEADER)&(pNTHeaders->OptionalHeader);
     pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((BYTE *)hMod + pOptHeader->DataDirectory[1].VirtualAddress);

    while(pImportDescriptor->FirstThunk)
    {
          char * dllname = (char *)((BYTE *)hMod + pImportDescriptor->Name);

           pThunkData = (PIMAGE_THUNK_DATA)((BYTE *)hMod + pImportDescriptor->OriginalFirstThunk);

          int no = 1;
          while(pThunkData->u1.Function)
          {
                char * funname = (char *)((BYTE *)hMod + (DWORD)pThunkData->u1.AddressOfData + 2);
                 PDWORD lpAddr = (DWORD *)((BYTE *)hMod + (DWORD)pImportDescriptor->FirstThunk) +(no-1);
          
                //修改內存的部分
                if((*lpAddr) == (int)addr)
                {
                    //修改內存頁的屬性
                     DWORD dwOLD;
                     MEMORY_BASIC_INFORMATION mbi;
                    VirtualQuery(lpAddr,&mbi,sizeof(mbi));
                    VirtualProtect(lpAddr,sizeof(DWORD),PAGE_READWRITE,&dwOLD);
                    
                    WriteProcessMemory(GetCurrentProcess(),
                                 lpAddr, &myaddr, sizeof(DWORD), NULL);
                    //恢復內存頁的屬性
                    VirtualProtect(lpAddr,sizeof(DWORD),dwOLD,0);
                }
                 no++;
                 pThunkData++;
          }

           pImportDescriptor++;
    }
}

//自己定義的方法
int WINAPI MessageBoxProxy(IN HWND hWnd, IN LPCSTR lpText, IN LPCSTR lpCaption, IN UINT uType)
{
    return       ((PFNMESSAGEBOX)addr)(NULL, "gxter_test", "gxter_title", 0);
    //可以寫代碼進程其它操作
}