请教一个关于 API 不能正确 Hook 的问题。 ( 积分: 100 )

yanghaijun · 2005-08-11

我用“Delphi 深入核心编程”中所讲的方法写了个 API Hook 程序，但令我不明白的是，在 cmd.exe 中运行命令（诸如：dir *.* > temp.txt），我却无法勾到 CreateFileW 、 MoveFileW 之类，当然在其它一般的使用时是可以勾到的，请问这是何原因。

yanghaijun · 2005-08-11

我用“Delphi 深入核心编程”中所讲的方法写了个 API Hook 程序，但令我不明白的是，在 cmd.exe 中运行命令（诸如：dir *.* > temp.txt），我却无法勾到 CreateFileW 、 MoveFileW 之类，当然在其它一般的使用时是可以勾到的，请问这是何原因。

wqyzsh · 2005-08-11

在CMD.EXE中,这时只能勾到: CreateFileA,MoveFileA等

余远源 · 2005-08-11

是的.做不到.如果要完美的話,得寫驅動. 我也不確定原因,不知是沒法得到輸入表,還是SetWindowsHookEx没法进入到在控制台中运行的程序。自己做个实验试试看。

yanghaijun · 2005-08-12

我用 API Hook SDK 是可以勾到的（不是驱动，与该书的方法同理），可惜无法得到该 SDK 的源码，并且启动比较慢，有些时候也勾不上。书中方法是不是只能勾住进程而勾不住进程产生的线程？

无泪 · 2005-08-12

对了，对了！

andyzhouap98111 · 2005-08-12

请问那本书在那有下载

yanghaijun · 2005-08-12

to 无泪： 　　有何指教？

tt.t · 2005-10-24

2k + sp4测试通过。 因为看到你的帖子才作的这个东西，所以代码很乱，许多东西都是从以前的代码东拼西凑出来的，有很大的优化空间。 因为你会做这类的东西，所以也没写注释，凑活看吧。 下面代码还不能hook仅导出Ordinal的函数，需要的话自己加吧，位置已经留出来了。 ==============Unit1.pas(Hookdll Loader)============== unit Unit1; interface uses  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,  Dialogs, StdCtrls; type  TForm1 = class(TForm)    Button1: TButton;    // only a button    procedure Button1Click(Sender: TObject);  private  public  end; var  Form1: TForm1; implementation {$R *.dfm} const  VictimExe = 'c:/winnt/system32/cmd.exe';//'C:/Program Files/Borland/Delphi6/Projects/APIHOOK/test/test.exe';  HookDll = 'NewHook.dll'; var  si: STARTUPINFO;  pi: PROCESS_INFORMATION; function EnabledDebugPrivilege(const bEnabled: Boolean):Boolean; var  hToken: THandle;  tp: TOKEN_PRIVILEGES;  a: DWORD; const  SE_DEBUG_NAME = 'SeDebugPrivilege'; begin  Result:=False;  if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, hToken)) then  begin    tp.PrivilegeCount :=1;    LookupPrivilegeValue(nil,SE_DEBUG_NAME ,tp.Privileges[0].Luid);    if bEnabled then      tp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED    else      tp.Privileges[0].Attributes := 0;    a:=0;    AdjustTokenPrivileges(hToken,False,tp,SizeOf(tp),nil,a);    Result:= GetLastError = ERROR_SUCCESS;    CloseHandle(hToken);  end; end; function InjectDll(hProc:Cardinal; Dll:string):Cardinal; var  wDllPath

wideChar;  pRemote

ointer;  cbSize:cardinal;  TempVar:Cardinal; begin  result:=0;  if hProc=0 then exit;  EnabledDebugPrivilege(true);  cbSize:= length(Dll) * 2 + 21;  GetMem(wDllPath,cbSize);  StringToWideChar(Dll,wDllPath,cbSize);  try    pRemote:=VirtualAllocEx( hProc, nil, cbSize, MEM_COMMIT, PAGE_READWRITE);    if WriteProcessMemory(hProc,pRemote, wDllPath, cbSize, TempVar) then    begin      TempVar:=0;      Result := CreateRemoteThread(hProc, nil, 0,                              GetProcAddress(GetModuleHandle('Kernel32'),                              'LoadLibraryW'), pRemote, 0, TempVar);      VirtualFreeEx(hProc, pRemote, 0, MEM_DECOMMIT or MEM_RELEASE);    end;  finally    FreeMem(wDllPath);  end; end; procedure CreateVictimProcess(Path: String); begin      ZeroMemory(@si, sizeof(STARTUPINFO));  si.cb := sizeof(STARTUPINFO);  if not CreateProcess(PChar(Path), nil, nil, nil, False, CREATE_SUSPENDED or CREATE_DEFAULT_ERROR_MODE, nil, nil, si, pi) then  begin    ShowMessage('CreateProcess failed!');    exit;  end; end; procedure TForm1.Button1Click(Sender: TObject); begin  CreateVictimProcess(VictimExe);  InjectDll(pi.hProcess, HookDll);  Sleep(20);  ResumeThread(pi.hThread); end; end. ============NewHook.dpr(NewHook.dll)============= library NewHook; uses  JwaWinType,  JwaWinNt,  JwaWinUser,  JwaWinBase,  JwaWinGdi,  Classes,  SysUtils; const  Func2Hook = 'CreateFileW';  FuncInDll = 'Kernel32.dll'; var  pFunc: Pointer = nil;  pOriginFunc: Pointer; function NewCreateFileW(lpFileName: LPCWSTR; dwDesiredAccess, dwShareMode: DWORD;  lpSecurityAttributes: LPSECURITY_ATTRIBUTES; dwCreationDisposition: DWORD;  dwFlagsAndAttributes: DWORD; hTemplateFile: HANDLE): HANDLE; stdcall; var oc: function (lpFileName: LPCWSTR; dwDesiredAccess, dwShareMode: DWORD;  lpSecurityAttributes: LPSECURITY_ATTRIBUTES; dwCreationDisposition: DWORD;  dwFlagsAndAttributes: DWORD; hTemplateFile: HANDLE): HANDLE; stdcall; dc:hdc; begin  dc := getdc(0);  textout(dc, 20, 20, 'CreateFileW!', 12);  releasedc(0, dc);  oc := pOriginFunc;  oc(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition,  dwFlagsAndAttributes, hTemplateFile); end; function NewMessageBoxA(AWnd: HWND; lpText, lpCaption: PAnsiChar; uType: UINT): Integer; stdcall; var  ofunc: function (AWnd: HWND; lpText, lpCaption: PAnsiChar; uType: UINT): Integer; stdcall; begin  ofunc := pOriginFunc;  result := ofunc(AWnd, PChar('Hooked!!! ' + lpText), lpCaption, uType); end; function FuncInImage: Cardinal;  //Return ImageBase var  peb, ldr, flink, p, bs,ep

DWORD; begin  result := 0;  asm    mov eax,fs:[$30]    mov peb,eax  end;  ldr:=pointer(dword(pointer(dword(peb)+12)^));  flink:=pointer(dword(pointer(dword(ldr)+12)^));  p:=flink;  repeat    bs:=pointer(pointer(dword(p)+$18)^);      //    Base address    ep:=pointer(pointer(dword(p)+$20)^);      //    Size of image    if (DWORD(pFunc) > DWORD(bs)) and (DWORD(pFunc) < DWORD(bs) + DWORD(ep)) then    begin      result := DWORD(bs);      Break;    end;    p:=pointer(dword(p^));  until dword(flink)=dword(p^); end; procedure FixExport(ImageBase: Cardinal); var  PFileHeader: PImageFileHeader;  POptionalHeader32: PImageOptionalHeader32;  PExportDirectory: PImageExportDirectory;  PDataDirectory: PImageDataDirectory;  ExpCount: integer;  pAddr: PDWORD;  pName0, pName1: PDWORD;  pOrdinal0, pOrdinal1: PWORD;  ExpFound: Boolean;  i, j: Cardinal; begin  PFileHeader := PImageFileHeader(ImageBase + PImageDosHeader(ImageBase)^.e_lfanew + 4);  POptionalHeader32 := PImageOptionalHeader32(DWORD(PFileHeader) + IMAGE_SIZEOF_FILE_HEADER);  PDataDirectory := PImageDataDirectory(@POptionalHeader32^.DataDirectory[0]);  inc(PDataDirectory, IMAGE_DIRECTORY_ENTRY_EXPORT);  PExportDirectory := PImageExportDirectory(ImageBase +PDataDirectory^.VirtualAddress);  ExpCount := PExportDirectory^.NumberOfFunctions;  pAddr := Pointer(ImageBase + PExportDirectory^.AddressOfFunctions);  pName0 := Pointer(ImageBase + PExportDirectory^.AddressOfNames);  pOrdinal0 := Pointer(ImageBase + PExportDirectory^.AddressOfNameOrdinals);  for i := 0 to ExpCount - 1 do  begin    if pAddr^ <> 0 then    begin      ExpFound := false;      pName1 := pName0;      pOrdinal1 := pOrdinal0;      for j := 0 to PExportDirectory^.NumberOfNames - 1 do              begin        if pOrdinal1^ = i then        begin          if PChar(ImageBase + pName1^) = Func2Hook then          begin            ExpFound := true;            pOriginFunc := Pointer(ImageBase + pAddr^);            break;          end;        end;        inc(pOrdinal1);        inc(pName1);      end;  // for j        if ExpFound then        begin          Break; //          tmpExp^.Orindal := pOrdinal1^ + ExpPtr^.Base;        end; //        else //        tmpExp^.Orindal := i + ExpPtr^.Base;    end;  //if pAddr^ <> 0    inc(pAddr);  end;  // for i  virtualprotect(pAddr, 4, $40, @i);  pAddr^ := DWORD(@NewCreateFileW) - ImageBase; end; function FuncUsed(ImageBase: Cardinal): Pointer; var  PFileHeader: PImageFileHeader;  POptionalHeader32: PImageOptionalHeader32;  PImportDecriptor: PImageImportDecriptor;  PDataDirectory: PImageDataDirectory;  i, j: integer; begin  result := nil;  PFileHeader := PImageFileHeader(ImageBase + PImageDosHeader(ImageBase)^.e_lfanew + 4);  POptionalHeader32 := PImageOptionalHeader32(DWORD(PFileHeader) + IMAGE_SIZEOF_FILE_HEADER);  PDataDirectory := PImageDataDirectory(@POptionalHeader32^.DataDirectory[0]);  inc(PDataDirectory, IMAGE_DIRECTORY_ENTRY_IMPORT);  if PDataDirectory^.Size = 0 then    exit;  PImportDecriptor := PImageImportDecriptor(ImageBase +PDataDirectory^.VirtualAddress);  while (PImportDecriptor^.Union.OriginalFirstThunk <> 0) or (PImportDecriptor^.TimeDateStamp <> 0) or    (PImportDecriptor^.ForwarderChain <> 0) or (PImportDecriptor^.Name <> 0) or (PImportDecriptor^.FirstThunk <> 0) do  begin    if CompareText(PChar(ImageBase + PImportDecriptor^.Name), FuncInDll)=0 then    begin //      if PImportDecriptor^.Union.OriginalFirstThunk <> 0 then //       j := ImageBase + PImportDecriptor^.Union.OriginalFirstThunk //      else        j := ImageBase + PImportDecriptor^.FirstThunk;      while PDWORD(j)^ <> 0 do      begin        if PDWORD(j)^ and IMAGE_ORDINAL_FLAG32 = 0 then        begin          if PDWORD(j)^ = DWORD(pOriginFunc) then          begin //            asm int 3 end;            virtualprotect(Pointer(j), 4, $40, @i);            PDWORD(j)^ :=  DWORD(@NewCreateFileW);          end;          //          //  Ordinal only support here          //        end;        inc(j, 4);      end;    end;    inc(PImportDecriptor);  end; end; procedure FixImport; var  peb, ldr, flink, p, bs

DWORD; begin  asm    mov eax,fs:[$30]    mov peb,eax  end;  ldr:=pointer(dword(pointer(dword(peb)+12)^));  flink:=pointer(dword(pointer(dword(ldr)+12)^));  p:=flink;  repeat    bs:=pointer(pointer(dword(p)+$18)^);      //    Base address    FuncUsed(DWORD(bs));    p:=pointer(dword(p^));  until dword(flink)=dword(p^); end; procedure EntryPointProc(Reason: Integer); var  ExpImageBase: Cardinal; begin          if Reason <> DLL_PROCESS_ATTACH then    exit;  pFunc := GetProcAddress(GetModuleHandle(FuncInDll), Func2Hook);  ExpImageBase := FuncInImage;  if ExpImageBase <> GetModuleHandle(nil) then    FixExport(ExpImageBase);  FixImport; end; begin      DllProc := @EntryPointProc;  EntryPointProc(DLL_PROCESS_ATTACH); end.

yanghaijun · 2005-08-24

谢谢先，我试试看

tt.t · 2005-08-24

这个东西现在还有问题，我还要再改改

tt.t · 2005-08-26

改进完成，试试这个 //------------------------------ object Form1: TForm1  Left = 195  Top = 109  Width = 248  Height = 167  Caption = 'Form1'  Color = clBtnFace  Font.Charset = DEFAULT_CHARSET  Font.Color = clWindowText  Font.Height = -11  Font.Name = 'MS Sans Serif'  Font.Style = []  OldCreateOrder = False  PixelsPerInch = 96  TextHeight = 13  object Button1: TButton    Left = 48    Top = 72    Width = 145    Height = 57    Caption = 'Button1'    TabOrder = 0    OnClick = Button1Click  end  object RadioButton1: TRadioButton    Left = 64    Top = 8    Width = 113    Height = 17    Caption = 'cmd.exe'    Checked = True    TabOrder = 1    TabStop = True  end  object RadioButton2: TRadioButton    Left = 64    Top = 40    Width = 113    Height = 17    Caption = 'fsg.exe'    TabOrder = 2  end end //----------------------------- unit Unit1; interface uses  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,  Dialogs, StdCtrls; type  TForm1 = class(TForm)    Button1: TButton;    RadioButton1: TRadioButton;    RadioButton2: TRadioButton;    procedure Button1Click(Sender: TObject);  private  public  end; var  Form1: TForm1; implementation {$R *.dfm} const  HookDll = 'C:/Program Files/Borland/Delphi6/Projects/APIHOOK/HookDll/HookDll.dll'; var  si: STARTUPINFO;  pi: PROCESS_INFORMATION; function EnabledDebugPrivilege(const bEnabled: Boolean):Boolean; var  hToken: THandle;  tp: TOKEN_PRIVILEGES;  a: DWORD; const  SE_DEBUG_NAME = 'SeDebugPrivilege'; begin  Result:=False;  if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, hToken)) then  begin    tp.PrivilegeCount :=1;    LookupPrivilegeValue(nil,SE_DEBUG_NAME ,tp.Privileges[0].Luid);    if bEnabled then      tp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED    else      tp.Privileges[0].Attributes := 0;    a:=0;    AdjustTokenPrivileges(hToken,False,tp,SizeOf(tp),nil,a);    Result:= GetLastError = ERROR_SUCCESS;    CloseHandle(hToken);  end; end; function InjectDll(hProc:Cardinal; Dll:string):Cardinal; var  wDllPath

wideChar;  pRemote

ointer;  cbSize:cardinal;  TempVar:Cardinal; begin  result:=0;  if hProc=0 then exit;  EnabledDebugPrivilege(true);  cbSize:= length(Dll) * 2 + 21;  GetMem(wDllPath,cbSize);  StringToWideChar(Dll,wDllPath,cbSize);  try    pRemote:=VirtualAllocEx( hProc, nil, cbSize, MEM_COMMIT, PAGE_READWRITE);    if WriteProcessMemory(hProc,pRemote, wDllPath, cbSize, TempVar) then    begin      TempVar:=0;      Result := CreateRemoteThread(hProc, nil, 0,                              GetProcAddress(GetModuleHandle('Kernel32'),                              'LoadLibraryW'), pRemote, 0, TempVar);      VirtualFreeEx(hProc, pRemote, 0, MEM_DECOMMIT or MEM_RELEASE);    end;  finally    FreeMem(wDllPath);  end; end; procedure CreateVictimProcess(Path: String); begin      ZeroMemory(@si, sizeof(STARTUPINFO));  si.cb := sizeof(STARTUPINFO);  if not CreateProcess(PChar(Path), nil, nil, nil, False, CREATE_SUSPENDED or CREATE_DEFAULT_ERROR_MODE, nil,                       PChar(ExtractFilePath(Path)), si, pi) then  begin    ShowMessage('CreateProcess failed! ' + syserrormessage(getlasterror));    exit;  end; end; procedure TForm1.Button1Click(Sender: TObject); var  VictimExe: string; begin  if RadioButton1.Checked then    VictimExe := 'c:/winnt/system32/cmd.exe'  else    VictimExe := 'E:/CB/fsg/fsg.exe';  CreateVictimProcess(VictimExe);  InjectDll(pi.hProcess, HookDll);  Sleep(20);  ResumeThread(pi.hThread); end; end. //----------------------------- library NewHook; uses  {Jedi header}  JwaWinType,  JwaWinNt,  JwaWinUser,  JwaWinBase,  JwaWinGdi,  JwaWinNLS; const  Func2Hook: PChar = 'CreateFileW';  FuncInDll: PChar = 'Kernel32.dll'; var  pOriginFunc: Pointer = nil;  pNewFunc: Pointer = nil;  DllHash: Cardinal = 0;  MainProcImageBase: Cardinal = 0;  MainProcImageSize: Cardinal = 0;     function NewCreateFileW(lpFileName: LPCWSTR; dwDesiredAccess, dwShareMode: DWORD;  lpSecurityAttributes: LPSECURITY_ATTRIBUTES; dwCreationDisposition: DWORD;  dwFlagsAndAttributes: DWORD; hTemplateFile: HANDLE): HANDLE; stdcall; var  oc: function (lpFileName: LPCWSTR; dwDesiredAccess, dwShareMode: DWORD;                lpSecurityAttributes: LPSECURITY_ATTRIBUTES; dwCreationDisposition: DWORD;                dwFlagsAndAttributes: DWORD; hTemplateFile: HANDLE): HANDLE; stdcall;  dc:hdc;  Path: PChar;  lPath: Cardinal;  FileName: String;  RtnAddress: DWORD; begin  asm    mov eax, [esp + $C]   //overleap 3 "push", generated by compiler    mov RtnAddress, eax  end; //  if (RtnAddress >= MainProcImageBase) and (RtnAddress <= MainProcImageBase + MainProcImageSize) then  begin    {the call is from the main process }    dc := getdc(0);    textout(dc, 10, 20, PChar(Func2Hook + ' detected!'), length(Func2Hook) + 10);   //show we did it!    releasedc(0, dc);  end;  lPath := GetCurrentDirectory(0, nil);  GetMem(Path, lPath);  ZeroMemory(Path, lPath);  GetCurrentDirectory(lPath, Path);  FileName := WideCharToString(lpFileName);  try    MessageBox(0, PChar('File path: ' + Path + FileName), 'CreateFileW Notify', MB_OK);  finally    FreeMem(Path);  end;  oc := pOriginFunc;  result := oc(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition,               dwFlagsAndAttributes, hTemplateFile); end; (*************************************************) (*                                               *) (*           Hook Process Start Here             *) (*                                               *) (*************************************************) function CalcHash(pText: Pointer): Cardinal; begin  result := 0;  while PByte(pText)^ <> 0 do  begin    result := ((result shl 5) or (result shr 15)) + PByte(pText)^;    if (PByte(pText)^ >= $61) and (PByte(pText)^ <= $7A) then  //UpperCase (Makes hash case insensitive)      dec(result, 32);    inc(PByte(pText));  end; end; function GetSectionPtr(ImageBase: Cardinal; SectionIndex: integer): Pointer; var  PFileHeader: PImageFileHeader;  POptionalHeader32: PImageOptionalHeader32;  PDataDirectory: PImageDataDirectory; begin  result := nil;  PFileHeader := PImageFileHeader(ImageBase + DWORD(PImageDosHeader(ImageBase)^.e_lfanew) + 4);  POptionalHeader32 := PImageOptionalHeader32(DWORD(PFileHeader) + IMAGE_SIZEOF_FILE_HEADER);  PDataDirectory := PImageDataDirectory(@POptionalHeader32^.DataDirectory[0]);  inc(PDataDirectory, SectionIndex);      if PDataDirectory^.Size = 0 then    exit;  result := PImageExportDirectory(ImageBase +PDataDirectory^.VirtualAddress); end; procedure FixExport(ImageBase: Cardinal; OriginExpRVA: DWORD; NewExpRVA: DWORD); var  PExportDirectory: PImageExportDirectory;  pAddr: PDWORD;  i, OldProtect: Cardinal; begin  PExportDirectory := GetSectionPtr(ImageBase, IMAGE_DIRECTORY_ENTRY_EXPORT);  if PExportDirectory = nil then    exit;  pAddr := Pointer(ImageBase + PExportDirectory^.AddressOfFunctions);  for i := 0 to PExportDirectory^.NumberOfFunctions - 1 do  begin    if ImageBase + pAddr^ = OriginExpRVA then    begin      VirtualProtect(pAddr, SizeOf(DWORD), PAGE_READWRITE, @OldProtect);      pAddr^ := NewExpRVA;      VirtualProtect(pAddr, SizeOf(DWORD), OldProtect, @OldProtect);      Break;    end;    inc(pAddr);  end;  // for i end; procedure FixImport(ImageBase: Cardinal; OriginAddr: DWORD; NewAddr: DWORD); var  PImportDecriptor: PImageImportDecriptor;  TmpVar: DWORD;  pThunk: PDWORD; begin  PImportDecriptor := GetSectionPtr(ImageBase, IMAGE_DIRECTORY_ENTRY_IMPORT);  if PImportDecriptor = nil then    exit;  while PImportDecriptor^.FirstThunk <> 0 do  //After loaded, FirstThunk must be valid !  begin    if CalcHash(PChar(ImageBase + PImportDecriptor^.Name)) = DllHash then    begin      pThunk := PDWORD(ImageBase + PImportDecriptor^.FirstThunk);      while pThunk^ <> 0 do      begin        if pThunk^ = OriginAddr then        begin          VirtualProtect(pThunk, 4, $40, @TmpVar);          pThunk^ := NewAddr;          Break;        end;        inc(pThunk);      end;    end;    inc(PImportDecriptor);  end; end; procedure DoHook(OldAddr, NewAddr, NewRVA: DWORD); var  PEB, Ldr, fLink: DWORD;  p: PDWORD;  ImageBase, ImageSize: DWORD; begin  asm    mov eax, fs: [$30]    mov PEB, eax  end;  Ldr := PDWORD(PEB + $C)^;  fLink := PDWORD(Ldr + $C)^;  p := PDWORD(fLink);  repeat    ImageBase := PDWORD(DWORD(p) + $18)^;      //    Base address    ImageSize := PDWORD(DWORD(p) + $20)^;      //    Size of image    if ImageBase = GetModuleHandle(nil) then    begin      MainProcImageBase := ImageBase;      MainProcImageSize := ImageSize;    end;    if (DWORD(pOriginFunc) > ImageBase) and (DWORD(pOriginFunc) < ImageBase + ImageSize) then      FixExport(ImageBase, OldAddr, NewRVA - ImageBase);    FixImport(ImageBase, OldAddr, NewAddr);    p := PDWORD(p^);  until fLink = p^; end; procedure EntryPointProc(Reason: Integer); begin  if Reason = DLL_PROCESS_ATTACH then  begin    DllHash := CalcHash(FuncInDll);    pNewFunc := @NewCreateFileW; //    pOriginFunc := GetProcAddress(GetModuleHandle(FuncInDll), PChar(MakelParam($3C, 0))); {    GetProcAddress by ordinal. $3C is the ordinal of CreateFileW}    pOriginFunc := GetProcAddress(GetModuleHandle(FuncInDll), Func2Hook); {    GetProcAddress by name}    DoHook(DWORD(pOriginFunc), DWORD(pNewFunc), $100000000 + DWORD(pNewFunc));  end  else if Reason = DLL_PROCESS_DETACH then  begin    //Reset to original state.    DoHook(DWORD(pNewFunc), DWORD(pOriginFunc), DWORD(pOriginFunc));  end; end; begin      DllProc := @EntryPointProc;  EntryPointProc(DLL_PROCESS_ATTACH); end.

yanghaijun · 2005-08-28

uses  {Jedi header}  JwaWinType,  JwaWinNt,  JwaWinUser,  JwaWinBase,  JwaWinGdi,  JwaWinNLS; 这些单元是什么？在哪？

tt.t · 2005-08-29

http://www.delphi-jedi.org/APILIBRARY:297648 ftp://delphi-jedi.org/api/win32api.zip

yanghaijun · 2005-08-30

谢谢，好东西

tt.t · 2005-09-05

楼主哪去了，行不行到时露个面啊

fan2588 · 2005-09-16

这个好象有针对性,如果我想HOOK全局,所有进程好象不行吧

tt.t · 2005-09-19

确实是有针对性，不过不要指望ring 3级的api hook能有多么好的兼容性，毕竟这是一种不规范的做法。对付普通程序还行，要是对付某些壳就会比较麻烦。

yanghaijun · 2005-09-29

你的意思是说，还是用驱动？

yanghaijun · 2005-09-29

正如前面所说，具有针对性，因而适应的情况不广

请教一个关于 API 不能正确 Hook 的问题。 ( 积分: 100 )

yanghaijun

Unregistered / Unconfirmed

yanghaijun

Unregistered / Unconfirmed

wqyzsh

Unregistered / Unconfirmed

余远源

Unregistered / Unconfirmed

yanghaijun

Unregistered / Unconfirmed

无泪

Unregistered / Unconfirmed

andyzhouap98111

Unregistered / Unconfirmed

yanghaijun

Unregistered / Unconfirmed

tt.t

Unregistered / Unconfirmed

yanghaijun

Unregistered / Unconfirmed

tt.t

Unregistered / Unconfirmed

tt.t

Unregistered / Unconfirmed

yanghaijun

Unregistered / Unconfirmed

tt.t

Unregistered / Unconfirmed

yanghaijun

Unregistered / Unconfirmed

tt.t

Unregistered / Unconfirmed

fan2588

Unregistered / Unconfirmed

tt.t

Unregistered / Unconfirmed

yanghaijun

Unregistered / Unconfirmed

yanghaijun

Unregistered / Unconfirmed

Similar threads