unit Unit1;<br><br>interface<br><br>uses<br> Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,<br> Dialogs, StdCtrls;<br><br>type<br> TForm1 = class(TForm)<br> Button1: TButton;<br> procedure Button1Click(Sender: TObject);<br> private<br> { Private declarations }<br> public<br> { Public declarations }<br> <br> end;<br><br>var<br> Form1: TForm1;<br> hProcess: THandle;<br> pFnMsgBox: DWord;<br> dwOld: DWord;<br> jmp: array[1..5] of Byte;<br> enter: array[1..5] of Byte;<br> procedure SetupHook;<br> procedure RemoveHook;<br> function MessageBoxProxy(hWnd: THandle; lpText: Pchar; lpcStr: PChar; uType: Word): Integer; stdcall;<br> <br>implementation<br><br>{$R *.dfm}<br><br>function MessageBoxProxy(hWnd: THandle; lpText: PAnsichar; lpcStr: PAnsichar; uType: Word): Integer; stdcall;<br>begin<br> Result := 0;<br> ShowMessage('先登录吧!');<br> CopyMemory(Pointer(pfnMsgBox), @enter, 5); //恢复入口指令<br> FlushInstructionCache(hWnd, Pointer(pfnMsgBox), 5);<br> Result := MessageBox(hWnd, lpText, lpcStr, uType); //调用原函数<br> CopyMemory(Pointer(pfnMsgBox), @jmp, 5); //写入跳转指令<br> FlushInstructionCache(hProcess,Pointer(pfnMsgBox),5);<br>end;<br><br>procedure RemoveHook;<br>var<br> dwTemp: DWord;<br>begin<br> CopyMemory(Pointer(pfnMsgBox), @enter, 5);<br> FlushInstructionCache(hProcess, Pointer(pfnMsgBox), 5);<br> VirtualProtect(Pointer(pfnMsgBox), 5, dwOld, @dwTemp);<br>end;<br><br>procedure SetupHook;<br>begin <br> pFnMsgBox := DWord(GetProcAddress(GetModuleHandle(Pchar('user32.dll')),PChar('MessageBoxA')));<br> ZeroMemory(pChar(@enter),sizeof(enter));<br> CopyMemory(@enter, Pointer(pfnMsgBox), 5); //保存入口指令<br> ZeroMemory(pChar(@jmp),sizeof(jmp));<br><br> jmp[1]:= $E9;<br> PInteger(@jmp[2])^ := (Integer(@MessageBoxProxy)-(Integer(pfnMsgBox)+5));<br> VirtualProtect(Pointer(pfnMsgBox), 5, PAGE_EXECUTE_READWRITE,@dwOld);<br> CopyMemory(Pointer(pfnMsgBox), @jmp, 5);<br>end;<br><br><br><br>procedure TForm1.Button1Click(Sender: TObject);<br>begin<br> hProcess:=GetCurrentProcess();<br> SetupHook();<br> MessageBox(handle,Pchar('Hook Demo!'), Pchar('API Hook'),MB_ICONINFORMATION);<br> <br> RemoveHook();<br> MessageBox(handle, Pchar('Hook Demo2!'), Pchar('API Hook2'),MB_ICONINFORMATION);<br>end;<br><br><br><br>end.