I
iNFRARED
Unregistered / Unconfirmed
GUEST, unregistred user!
我用改写Jump的方法写了个APIHOOK程序,可是发现不能拦截被压缩的程序<br>(如ASPack压缩过的程序),请高手指点怎么解决。(自己用Delphi写的程序和记事本等<br>程序都能拦截)<br><br>源程序如下:<br><br>DLL部分<br>===================================<br>library HOOK;<br><br>uses<br> Windows,<br> WinSock,<br> SysUtils,<br> Classes,<br> PERecord in 'PERecord.pas';<br><br>{$R *.res}<br><br>type<br> TMessageBoxA=function(hwn:hwnd;iptextchar;ipcaptionchar;utype:cardinal):integer;stdcall;<br> TMessageBoxW=function(hwn:hwnd;iptextchar;ipcaptionchar;utype:cardinal):integer;stdcall;<br>var<br> HookHandle: THandle;<br> OldMessageBoxA:TMessageBoxA;<br> OldMessageBoxW:TMessageBoxW;<br><br>function LocateFunctionAddress(Codeointer)ointer;<br>var<br> funcImportCode;<br>begin<br> Result:=Code;<br> if Code=nil then exit;<br> try<br> func:=Code;<br> if(func.JumpInstruction=$25FF) then<br> begin<br> Result:=func.AddressOfPointerToFunction^;<br> end;<br> except<br> Result:=nil;<br> end;<br>end;<br><br>function RepointFunction(OldFunc, NewFunc: Pointer): Integer;<br>var<br> IsDone: TList;<br> function RepointAddrInModule(hModule: THandle; OldFunc, NewFunc: Pointer): Integer;<br> var<br> Dos: PImageDosHeader;<br> NT: PImageNTHeaders;<br> ImportDesc: PImage_Import_Entry;<br> RVA: DWORD;<br> Func: ^Pointer;<br> DLL: string;<br> f: Pointer;<br> written: DWORD;<br> begin<br> Result := 0;<br> Dos := Pointer(hModule);<br> if IsDone.IndexOf(Dos) >= 0 then exit;<br> IsDone.Add(Dos);<br><br> OldFunc := LocateFunctionAddress(OldFunc);<br><br> if IsBadReadPtr(Dos, SizeOf(TImageDosHeader)) then exit;<br> if Dos.e_magic <> IMAGE_DOS_SIGNATURE then exit;<br> NT := Pointer(Integer(Dos) + dos._lfanew);<br><br> RVA := NT^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]<br> .VirtualAddress;<br><br> if RVA = 0 then exit;<br> ImportDesc := pointer(integer(Dos) + RVA);<br> while (ImportDesc^.Name <> 0) do<br> begin<br> DLL := PChar(Integer(Dos) + ImportDesc^.Name);<br> RepointAddrInModule(GetModuleHandle(PChar(DLL)), OldFunc, NewFunc);<br> Func := Pointer(Integer(DOS) + ImportDesc.LookupTable);<br> while Func^ <> nil do<br> begin<br> f := LocateFunctionAddress(Func^);<br> if f = OldFunc then<br> begin<br> WriteProcessMemory(GetCurrentProcess, Func, @NewFunc, 4, written);<br> if Written > 0 then Inc(Result);<br> end;<br> Inc(Func);<br> end;<br> Inc(ImportDesc);<br> end;<br> end;<br><br>begin<br> IsDone := TList.Create;<br> try<br> Result := RepointAddrInModule(GetModuleHandle(nil), OldFunc, NewFunc);<br> finally<br> IsDone.Free;<br> end;<br>end;<br><br><br>function MyMessageBoxA(hwn:hwnd;iptextchar;ipcaptionchar;utype:cardinal):integer;stdcall;<br>begin<br> Result:=OldMessageBoxA(hwn,'ok','ok',MB_OK);<br>end;<br><br>function MyMessageBoxW(hwn:hwnd;iptextchar;ipcaptionchar;utype:cardinal):integer;stdcall;<br>begin<br> Result:=OldMessageBoxW(hwn,'ok','ok',MB_OK);<br>end;<br><br>function GetMsgProc(code: integer; removal: integer; msg: Pointer): Integer; stdcall;<br>begin<br> if @OldMessageBoxA=nil then<br> @OldMessageBoxA:=LocateFunctionAddress(@MessageBoxA);<br> if @OldMessageBoxW=nil then<br> @OldMessageBoxW:=LocateFunctionAddress(@MessageBoxW);<br> RepointFunction(@OldMessageBoxA,@MyMessageBoxA);<br> RepointFunction(@OldMessageBoxW,@MyMessageBoxW);<br>end;<br><br>procedure StartHook(dwThreadIdWORD); stdcall;<br>var<br> dwThreadIdMyWORD;<br>begin<br> //dwThreadIdMy:=GetcurrentThreadId();<br> HookHandle:=SetWindowsHookEx(WH_GETMESSAGE, @GetMsgProc, HInstance, dwThreadId);<br>end;<br><br>procedure StopHook; stdcall;<br>begin<br> UnhookWindowsHookEx(HookHandle);<br> if @OldMessageBoxA <> nil then<br> begin<br> RepointFunction(@MyMessageBoxA,@OldMessageBoxA);<br> RepointFunction(@MyMessageBoxW,@OldMessageBoxW);<br> end;<br>end;<br><br>exports StartHook, StopHook;<br><br>begin<br>end.<br>============================<br><br>结构定义部分<br>===========================<br>unit PERecord;<br><br>interface<br>uses Windows;<br><br>type<br> TImportCode = packed record<br> JumpInstruction:WORD;<br> AddressOfPointerToFunction:^Pointer;<br> end;<br> PImportCode=^TImportCode;<br> <br>type<br> PImageDosHeader = ^TImageDosHeader;<br> _IMAGE_DOS_HEADER = packed record<br> e_magic: Word;<br> e_cblp: Word;<br> e_cp: Word;<br> e_crlc: Word;<br> e_cparhdr: Word;<br> e_minalloc: Word;<br> e_maxalloc: Word;<br> e_ss: Word;<br> e_sp: Word;<br> e_csum: Word;<br> e_ip: Word;<br> e_cs: Word;<br> e_lfarlc: Word;<br> e_ovno: Word;<br> e_res: array [0..3] of Word;<br> e_oemid: Word;<br> e_oeminfo: Word;<br> e_res2: array [0..9] of Word;<br> _lfanew: LongInt;<br> end;<br> TImageDosHeader = _IMAGE_DOS_HEADER;<br><br> PIMAGE_FILE_HEADER = ^IMAGE_FILE_HEADER;<br> IMAGE_FILE_HEADER = packed record<br> Machine : WORD;<br> NumberOfSections : WORD;<br> TimeDateStamp : DWORD;<br> PointerToSymbolTable : DWORD;<br> NumberOfSymbols : DWORD;<br> SizeOfOptionalHeader : WORD;<br> Characteristics : WORD;<br> end;<br><br> PIMAGE_DATA_DIRECTORY = ^IMAGE_DATA_DIRECTORY;<br> IMAGE_DATA_DIRECTORY = packed record<br> VirtualAddress : DWORD;<br> Size : DWORD;<br> end;<br><br> PIMAGE_SECTION_HEADER = ^IMAGE_SECTION_HEADER;<br> IMAGE_SECTION_HEADER = packed record<br> Name : packed array [0..IMAGE_SIZEOF_SHORT_NAME-1] of Char;<br> VirtualSize : DWORD;<br> VirtualAddress : DWORD;<br> SizeOfRawData : DWORD;<br> PointerToRawData : DWORD;<br> PointerToRelocations : DWORD;<br> PointerToLinenumbers : DWORD;<br> NumberOfRelocations : WORD;<br> NumberOfLinenumbers : WORD;<br> Characteristics : DWORD;<br> end;<br><br> PIMAGE_OPTIONAL_HEADER = ^IMAGE_OPTIONAL_HEADER;<br> IMAGE_OPTIONAL_HEADER = packed record<br> { Standard fields. }<br> Magic : WORD;<br> MajorLinkerVersion : Byte;<br> MinorLinkerVersion : Byte;<br> SizeOfCode : DWORD;<br> SizeOfInitializedData : DWORD;<br> SizeOfUninitializedData : DWORD;<br> AddressOfEntryPoint : DWORD;<br> BaseOfCode : DWORD;<br> BaseOfData : DWORD;<br> { NT additional fields. }<br> ImageBase : DWORD;<br> SectionAlignment : DWORD;<br> FileAlignment : DWORD;<br> MajorOperatingSystemVersion : WORD;<br> MinorOperatingSystemVersion : WORD;<br> MajorImageVersion : WORD;<br> MinorImageVersion : WORD;<br> MajorSubsystemVersion : WORD;<br> MinorSubsystemVersion : WORD;<br> Reserved1 : DWORD;<br> SizeOfImage : DWORD;<br> SizeOfHeaders : DWORD;<br> CheckSum : DWORD;<br> Subsystem : WORD;<br> DllCharacteristics : WORD;<br> SizeOfStackReserve : DWORD;<br> SizeOfStackCommit : DWORD;<br> SizeOfHeapReserve : DWORD;<br> SizeOfHeapCommit : DWORD;<br> LoaderFlags : DWORD;<br> NumberOfRvaAndSizes : DWORD;<br> DataDirectory : packed array [0..IMAGE_NUMBEROF_DIRECTORY_ENTRIES-1] of IMAGE_DATA_DIRECTORY;<br> Sections: packed array [0..9999] of IMAGE_SECTION_HEADER;<br> end;<br><br> PIMAGE_NT_HEADERS = ^IMAGE_NT_HEADERS;<br> IMAGE_NT_HEADERS = packed record<br> Signature : DWORD;<br> FileHeader : IMAGE_FILE_HEADER;<br> OptionalHeader : IMAGE_OPTIONAL_HEADER;<br> end;<br> PImageNtHeaders = PIMAGE_NT_HEADERS;<br> TImageNtHeaders = IMAGE_NT_HEADERS;<br><br> PIMAGE_IMPORT_DESCRIPTOR = ^IMAGE_IMPORT_DESCRIPTOR;<br> IMAGE_IMPORT_DESCRIPTOR = packed record<br> Characteristics: DWORD;<br> Name: DWORD;<br> FirstThunk: DWORD;<br> ForwarderChain: DWORD;<br> end;<br> TImageImportDescriptor = IMAGE_IMPORT_DESCRIPTOR;<br> PImageImportDescriptor = PIMAGE_IMPORT_DESCRIPTOR;<br><br> PIMAGE_IMPORT_BY_NAME = ^IMAGE_IMPORT_BY_NAME;<br> IMAGE_IMPORT_BY_NAME = record<br> Hint: Word;<br> Name: Array[0..0] of Char;<br> end;<br><br> PIMAGE_THUNK_DATA = ^IMAGE_THUNK_DATA;<br> IMAGE_THUNK_DATA = record<br> Whatever: DWORD;<br> end;<br><br> PImage_Import_Entry = ^Image_Import_Entry;<br> Image_Import_Entry = record<br> Characteristics: DWORD;<br> TimeDateStamp: DWORD;<br> MajorVersion: Word;<br> MinorVersion: Word;<br> Name: DWORD;<br> LookupTable: DWORD;<br> end;<br><br><br>const<br>IMAGE_DOS_SIGNATURE = $5A4D; // MZ<br>IMAGE_OS2_SIGNATURE = $454E; // NE<br>IMAGE_OS2_SIGNATURE_LE = $454C; // LE<br>IMAGE_VXD_SIGNATURE = $454C; // LE<br>IMAGE_NT_SIGNATURE = $00004550; // PE00<br><br>implementation<br><br>end.<br>====================<br><br>测试程序部分<br>====================<br>unit Unit1;<br><br>interface<br><br>uses<br> Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,<br> Dialogs, StdCtrls;<br><br>type<br> TForm1 = class(TForm)<br> Button1: TButton;<br> Button2: TButton;<br> Button3: TButton;<br> procedure Button1Click(Sender: TObject);<br> procedure Button2Click(Sender: TObject);<br> private<br> { Private declarations }<br> public<br> { Public declarations }<br> end;<br><br>var<br> Form1: TForm1;<br><br>implementation<br><br>{$R *.dfm}<br>procedure StartHook(dwThreadIdWORD); stdcall; external 'HOOK.DLL';<br>procedure StopHook; stdcall; external 'HOOK.DLL';<br><br>procedure TForm1.Button1Click(Sender: TObject);<br>Var<br> myWORD;<br> hwn:hwnd;<br>begin<br> hwn:=FindWindow('','XXX');<br> StartHook(GetWindowThreadProcessId(hwn));<br>end;<br><br>procedure TForm1.Button2Click(Sender: TObject);<br>begin<br> StopHook;<br>end;<br><br>end.<br><br>========================