X
xingsx
Unregistered / Unconfirmed
GUEST, unregistred user!
unit uHookApi;<br><br>interface<br><br>uses<br> Windows, ImageHlp, SysUtils;<br><br>const<br> IMAGE_ORDINAL_FLAG = $80000000;<br>type<br> PIMAGE_IMPORT_DESCRIPTOR = ^_IMAGE_IMPORT_DESCRIPTOR;<br> _IMAGE_IMPORT_DESCRIPTOR = packed record<br> Characteristics_OriginalFirstThunk: DWord;<br> TimeDateStamp: DWord;<br> ForwarderChain: DWord;<br> Name: DWord;<br> FirstThunk: DWord;<br> end;<br> PIMAGE_THUNK_DATA = ^_IMAGE_THUNK_DATA;<br> _IMAGE_THUNK_DATA = packed record<br> Case Integer of<br> 0 : (ForwarderString: DWord);<br> 1 : (Function_: DWord);<br> 2 : (Ordinal: DWord);<br> 3 : (AddressOfData: DWord);<br> end;<br> PIMAGE_IMPORT_BY_NAME = ^_IMAGE_IMPORT_BY_NAME;<br> _IMAGE_IMPORT_BY_NAME = packed record<br> Hint: Word;<br> Name: Byte;<br> end;<br><br>function GetImportDescriptor(hModule: Cardinal; DllName: PChar): Pointer;<br>function InterceptDllCall(hModule: Cardinal; DllName: PChar; oldProc, newProc: Pointer): Pointer;<br><br>implementation<br><br>function GetImportDescriptor(hModule: Cardinal; DllName: PChar): Pointer;<br>var pImpDesc: PIMAGE_IMPORT_DESCRIPTOR; iSize: Cardinal;<br>begin<br> Result := nil;<br> pImpDesc := ImageDirectoryEntryToData(Pointer(hModule), True, IMAGE_DIRECTORY_ENTRY_IMPORT, iSize);<br> if pImpDesc = nil then Exit;<br> while pImpDesc.Name<>0 do<br> begin<br> if StrComp(DllName, PChar(hModule + pImpDesc.Name)) = 0 then<br> begin<br> Result := pImpDesc;<br> Exit;<br> end;<br> Inc(pImpDesc);<br> end;<br>end;<br><br>function InterceptDllCall(hModule: Cardinal; DllName: PChar; oldProc, newProc: Pointer): Pointer;<br>var pImpDesc: PIMAGE_IMPORT_DESCRIPTOR;<br> pRealThunk: PIMAGE_THUNK_DATA;<br>begin<br> Result := nil;<br> pImpDesc := GetImportDescriptor(hModule, DllName);<br> if pImpDesc = nil then Exit;<br> pRealThunk := PIMAGE_THUNK_DATA(hModule + pImpDesc.FirstThunk);<br> while pRealThunk.Function_ <> 0 do<br> begin<br> if pRealThunk.Function_ = DWord(oldProc) then<br> begin<br> Result := Pointer(pRealThunk.Function_);<br> pRealThunk.Function_ := DWord(newProc);<br> Exit;<br> end;<br> Inc(pRealThunk);<br> end;<br>end;<br><br>end.