请高手帮忙看看这段HookApi代码为什么无法工作(100分)

X

xingsx

Unregistered / Unconfirmed
GUEST, unregistred user!
unit uHookApi;<br><br>interface<br><br>uses<br>&nbsp; Windows, ImageHlp, SysUtils;<br><br>const<br>&nbsp; IMAGE_ORDINAL_FLAG = $80000000;<br>type<br>&nbsp; PIMAGE_IMPORT_DESCRIPTOR = ^_IMAGE_IMPORT_DESCRIPTOR;<br>&nbsp; _IMAGE_IMPORT_DESCRIPTOR = packed record<br>&nbsp; &nbsp; Characteristics_OriginalFirstThunk: DWord;<br>&nbsp; &nbsp; TimeDateStamp: DWord;<br>&nbsp; &nbsp; ForwarderChain: DWord;<br>&nbsp; &nbsp; Name: DWord;<br>&nbsp; &nbsp; FirstThunk: DWord;<br>&nbsp; end;<br>&nbsp; PIMAGE_THUNK_DATA = ^_IMAGE_THUNK_DATA;<br>&nbsp; _IMAGE_THUNK_DATA = packed record<br>&nbsp; &nbsp; Case Integer of<br>&nbsp; &nbsp; &nbsp; 0 : (ForwarderString: DWord);<br>&nbsp; &nbsp; &nbsp; 1 : (Function_: DWord);<br>&nbsp; &nbsp; &nbsp; 2 : (Ordinal: DWord);<br>&nbsp; &nbsp; &nbsp; 3 : (AddressOfData: DWord);<br>&nbsp; end;<br>&nbsp; PIMAGE_IMPORT_BY_NAME = ^_IMAGE_IMPORT_BY_NAME;<br>&nbsp; _IMAGE_IMPORT_BY_NAME = packed record<br>&nbsp; &nbsp; Hint: Word;<br>&nbsp; &nbsp; Name: Byte;<br>&nbsp; end;<br><br>function GetImportDescriptor(hModule: Cardinal; DllName: PChar): Pointer;<br>function InterceptDllCall(hModule: Cardinal; DllName: PChar; oldProc, newProc: Pointer): Pointer;<br><br>implementation<br><br>function GetImportDescriptor(hModule: Cardinal; DllName: PChar): Pointer;<br>var pImpDesc: PIMAGE_IMPORT_DESCRIPTOR; iSize: Cardinal;<br>begin<br>&nbsp; Result := nil;<br>&nbsp; pImpDesc := ImageDirectoryEntryToData(Pointer(hModule), True, IMAGE_DIRECTORY_ENTRY_IMPORT, iSize);<br>&nbsp; if pImpDesc = nil then Exit;<br>&nbsp; while pImpDesc.Name&lt;&gt;0 do<br>&nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; if StrComp(DllName, PChar(hModule + pImpDesc.Name)) = 0 then<br>&nbsp; &nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Result := pImpDesc;<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Exit;<br>&nbsp; &nbsp; &nbsp; &nbsp; end;<br>&nbsp; &nbsp; &nbsp; Inc(pImpDesc);<br>&nbsp; &nbsp; end;<br>end;<br><br>function InterceptDllCall(hModule: Cardinal; DllName: PChar; oldProc, newProc: Pointer): Pointer;<br>var pImpDesc: PIMAGE_IMPORT_DESCRIPTOR;<br>&nbsp; &nbsp; pRealThunk: PIMAGE_THUNK_DATA;<br>begin<br>&nbsp; Result := nil;<br>&nbsp; pImpDesc := GetImportDescriptor(hModule, DllName);<br>&nbsp; if pImpDesc = nil then Exit;<br>&nbsp; pRealThunk := PIMAGE_THUNK_DATA(hModule + pImpDesc.FirstThunk);<br>&nbsp; while pRealThunk.Function_ &lt;&gt; 0 do<br>&nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; if pRealThunk.Function_ = DWord(oldProc) then<br>&nbsp; &nbsp; &nbsp; &nbsp; begin<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Result := Pointer(pRealThunk.Function_);<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pRealThunk.Function_ := DWord(newProc);<br>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Exit;<br>&nbsp; &nbsp; &nbsp; &nbsp; end;<br>&nbsp; &nbsp; &nbsp; Inc(pRealThunk);<br>&nbsp; &nbsp; end;<br>end;<br><br>end.
 
顶部