用陷阱式APIHOOK HOOK了一个API单自己又要用这个API怎么办? ( 积分: 100 )

我用这种办法实现的APIHOOK,但是现在我想在mybox函数中实现仍然用MessageBoxA来显示对话框,应该怎么办呢?<br>unit&nbsp;Unit4;<br><br>interface<br>uses<br>&nbsp;&nbsp;Windows;<br><br>type<br>&nbsp;&nbsp;mymsgboxa=function(hWnd:&nbsp;HWND;&nbsp;lpText,&nbsp;lpCaption:&nbsp;PAnsiChar;&nbsp;uType:&nbsp;UINT):&nbsp;Integer;&nbsp;stdcall;<br>&nbsp;&nbsp;Tjump=packed&nbsp;record<br>&nbsp;&nbsp;&nbsp;&nbsp;jumpcode:Byte;<br>&nbsp;&nbsp;&nbsp;&nbsp;addr:mymsgboxa;<br>&nbsp;&nbsp;&nbsp;&nbsp;MoveEAX:Word;<br>&nbsp;&nbsp;&nbsp;&nbsp;reservedbyte:Byte;<br>&nbsp;&nbsp;end;<br><br>var<br>&nbsp;&nbsp;old,jmp:Tjump;<br>&nbsp;&nbsp;processhandle:THandle;<br>&nbsp;&nbsp;oldmsgboxachar;<br>&nbsp;&nbsp;dwsizeWORD;<br>&nbsp;&nbsp;hookhd:THandle;<br><br>procedure&nbsp;load;<br>implementation<br>function&nbsp;mybox(hWnd:&nbsp;HWND;&nbsp;lpText,&nbsp;lpCaption:&nbsp;PAnsiChar;&nbsp;uType:&nbsp;UINT):&nbsp;Integer;&nbsp;stdcall;<br>begin<br>&nbsp;&nbsp;MessageBoxW(hWnd,'APIHook成功,感谢各位高人相助','Hook&nbsp;OK',uType);<br>end;&nbsp;&nbsp;<br>procedure&nbsp;HookApi;<br>var<br>&nbsp;&nbsp;DllMoudle:THandle;<br>begin<br>&nbsp;&nbsp;processhandle:=GetCurrentProcess;<br>&nbsp;&nbsp;DllMoudle:=LoadLibrary('user32.dll');<br>&nbsp;&nbsp;oldmsgboxa:=GetProcAddress(DllMoudle,'MessageBoxA');<br>&nbsp;&nbsp;jmp.jumpcode:=$B8;<br>&nbsp;&nbsp;jmp.addr:=@mybox;<br>&nbsp;&nbsp;jmp.MoveEAX:=$E0FF;<br>&nbsp;&nbsp;ReadProcessMemory(processhandle,oldmsgboxa,@old,8,dwsize);<br>&nbsp;&nbsp;WriteProcessMemory(processhandle,oldmsgboxa,@jmp,8,dwsize);<br>end;<br>procedure&nbsp;HookEnd;<br>begin<br>&nbsp;&nbsp;WriteProcessMemory(processhandle,oldmsgboxa,@old,8,dwsize);<br>end;<br>function&nbsp;msghook(ncode,wparam,lparam:Integer):LRESULT;stdcall;<br>begin<br>&nbsp;&nbsp;hookapi;<br>&nbsp;&nbsp;Result:=CallNextHookEx(hookhd,ncode,wparam,lparam);<br>end;<br>procedure&nbsp;load;<br>begin<br>&nbsp;&nbsp;hookhd:=SetWindowsHookEx(WH_GETMESSAGE,@msghook,HInstance,0);<br>end;<br><br>end.

先保存函数入口前面的几个字节，然后在替换函数中恢复前面的字节，再做一次原来函数的调用就可以调用原来的函数了，不过在退出替换函数前还要再次改写函数入口的几个字节。

但这样的话可能出现这样的问题:假如我HOOK&nbsp;CopyFile函数,然后&nbsp;要用CopyFile来Copy一个很大的文件,这样按楼上&nbsp;朋友的方法我暂时恢复原入口地址,那么此时如果我同时再去复制其他的文件那这些复制操作我就Hook不到了.<br>我现在有这样一个想法,但具体实现还有个问题<br><br>我想能得到我要Hook的函数在内存中的位置(打比方说我要CopyFile的位置是$01~$100,我就要得到这个$1~$100，但不知道如何得到),&nbsp;然后用createfilemapping来申请到一块与之大小对应的空间，然后用CopyMemory来把CopyFile给全部拷贝到申请的空间中去，然后在HookAPI中将CopyFile入口指向我用我申请到的空间入口不就可以了么？

问题好像比我想象的要复杂啊,我这样修改了代码:<br>DLL:<br>function&nbsp;mybox(hWnd:&nbsp;HWND;&nbsp;lpText,&nbsp;lpCaption:&nbsp;PAnsiChar;&nbsp;uType:&nbsp;UINT):&nbsp;Integer;&nbsp;stdcall;<br>var<br>&nbsp;&nbsp;maphd:THandle;<br>&nbsp;&nbsp;mapaddrChar;<br>&nbsp;&nbsp;myfunc:mymsgboxa;<br>begin<br>&nbsp;&nbsp;maphd:=OpenFileMapping(PAGE_EXECUTE_READWRITE,true,'syfunc');<br>&nbsp;&nbsp;mapaddr:=MapViewOfFile(maphd,FILE_MAP_ALL_ACCESS,0,0,0);<br>&nbsp;&nbsp;@myfunc:=oldmsgboxa&nbsp;-&nbsp;mi.lpBaseOfDll&nbsp;+&nbsp;mapaddr;<br>&nbsp;&nbsp;Result:=myfunc(hWnd,'APIHook&nbsp;A','Hook&nbsp;OK',uType);<br>end;<br>======================================================================<br>EXE:<br>procedure&nbsp;TForm1.Button1Click(Sender:&nbsp;TObject);<br>var<br>&nbsp;&nbsp;maphd,msghd:THandle;<br>&nbsp;&nbsp;msgaddr,naddrointer;<br>&nbsp;&nbsp;mdinfo:TModuleInfo;<br>begin<br>&nbsp;&nbsp;msghd:=LoadLibrary('user32.dll');<br>&nbsp;&nbsp;msgaddr:=GetProcAddress(msghd,'MessageBoxA');<br>&nbsp;&nbsp;GetModuleInformation(GetCurrentProcess,msghd,@mdinfo,SizeOf(mdinfo));<br>&nbsp;&nbsp;maphd:=CreateFileMapping($ffffffff,nil,PAGE_EXECUTE_READWRITE,0,mdinfo.SizeOfImage,'syfunc');<br>&nbsp;&nbsp;naddr:=MapViewOfFile(maphd,FILE_MAP_ALL_ACCESS,0,0,0);<br>&nbsp;&nbsp;CopyMemory(naddr,mdinfo.lpBaseOfDll,mdinfo.SizeOfImage);<br>&nbsp;&nbsp;load;<br>end;<br>===========================================================================<br>无法正常执行,跳出一个CPU窗口,还有一个DeBugger&nbsp;Fault&nbsp;Notification窗口，说<br>raised&nbsp;too&nbsp;many&nbsp;consecutive&nbsp;exceptions

终于知道那里错啦,原来<br>maphd:=OpenFileMapping(PAGE_EXECUTE_READWRITE,true,'syfunc');应该改为<br>maphd:=OpenFileMapping(FILE_MAP_ALL_ACCESS,true,'syfunc');<br>现在这个APIHook就完美了

完整代码,不过和我以前想的有点不同,我本想单独把MessageBoxA复制出来的,但没办法,只有把整个user32.dll都复制了，有点浪费内存，哪位高手知道怎样把MessageBoxA单独复制出来么？小弟虚心求教:<br>unit&nbsp;Unit4;<br><br>interface<br>uses<br>&nbsp;&nbsp;Windows,PsAPI;<br><br>type<br>&nbsp;&nbsp;mymsgboxa=function(hWnd:&nbsp;HWND;&nbsp;lpText,&nbsp;lpCaption:&nbsp;PAnsiChar;&nbsp;uType:&nbsp;UINT):&nbsp;Integer;&nbsp;stdcall;<br>&nbsp;&nbsp;Tjump=packed&nbsp;record<br>&nbsp;&nbsp;&nbsp;&nbsp;jumpcode:Byte;<br>&nbsp;&nbsp;&nbsp;&nbsp;addr:mymsgboxa;<br>&nbsp;&nbsp;&nbsp;&nbsp;MoveEAX:Word;<br>&nbsp;&nbsp;&nbsp;&nbsp;reservedbyte:Byte;<br>&nbsp;&nbsp;end;<br>procedure&nbsp;HookEnd;<br>procedure&nbsp;HookApi;<br>var<br>&nbsp;&nbsp;old,jmp:Tjump;<br>&nbsp;&nbsp;processhandle:THandle;<br>&nbsp;&nbsp;oldmsgboxaChar;<br>&nbsp;&nbsp;dwsizeWORD;<br>&nbsp;&nbsp;hookhd:THandle;<br>&nbsp;&nbsp;omsgbox,naddr:mymsgboxa;<br>&nbsp;&nbsp;mi:TModuleInfo;<br>procedure&nbsp;load;<br>implementation<br>function&nbsp;mybox(hWnd:&nbsp;HWND;&nbsp;lpText,&nbsp;lpCaption:&nbsp;PAnsiChar;&nbsp;uType:&nbsp;UINT):&nbsp;Integer;&nbsp;stdcall;<br>var<br>&nbsp;&nbsp;maphd:THandle;<br>&nbsp;&nbsp;mapaddrChar;<br>&nbsp;&nbsp;myfunc:mymsgboxa;<br>begin<br>&nbsp;&nbsp;maphd:=OpenFileMapping(FILE_MAP_ALL_ACCESS,true,'syfunc');<br>&nbsp;&nbsp;mapaddr:=MapViewOfFile(maphd,FILE_MAP_ALL_ACCESS,0,0,0);<br>&nbsp;&nbsp;@myfunc:=oldmsgboxa&nbsp;-&nbsp;mi.lpBaseOfDll&nbsp;+&nbsp;mapaddr;<br>&nbsp;&nbsp;Result:=myfunc(hWnd,'HookAPI暂时成功了，谢谢大家','Hook',uType);<br>end;<br><br>procedure&nbsp;HookApi;<br>var<br>&nbsp;&nbsp;DllMoudle:THandle;<br>begin<br>&nbsp;&nbsp;processhandle:=GetCurrentProcess;<br>&nbsp;&nbsp;DllMoudle:=GetModuleHandle('user32.dll');<br>&nbsp;&nbsp;oldmsgboxa:=GetProcAddress(DllMoudle,'MessageBoxA');<br>&nbsp;&nbsp;if&nbsp;oldmsgboxa&lt;&gt;nil&nbsp;then<br>&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;GetModuleInformation(GetCurrentProcess,DllMoudle,@mi,SizeOf(tmoduleinfo));<br>&nbsp;&nbsp;&nbsp;&nbsp;jmp.jumpcode:=$B8;<br>&nbsp;&nbsp;&nbsp;&nbsp;jmp.addr:=@mybox;<br>&nbsp;&nbsp;&nbsp;&nbsp;jmp.MoveEAX:=$E0FF;<br>&nbsp;&nbsp;&nbsp;&nbsp;ReadProcessMemory(processhandle,oldmsgboxa,@old,8,dwsize);<br>&nbsp;&nbsp;&nbsp;&nbsp;WriteProcessMemory(processhandle,oldmsgboxa,@jmp,8,dwsize);<br>&nbsp;&nbsp;end;<br>end;<br>procedure&nbsp;HookEnd;<br>begin<br>&nbsp;&nbsp;WriteProcessMemory(processhandle,oldmsgboxa,@old,8,dwsize);<br>end;<br>function&nbsp;msghook(ncode,wparam,lparam:Integer):LRESULT;stdcall;<br>begin<br>&nbsp;&nbsp;hookapi;<br>&nbsp;&nbsp;Result:=CallNextHookEx(hookhd,ncode,wparam,lparam);<br>end;<br>procedure&nbsp;load;<br>begin<br>&nbsp;&nbsp;hookhd:=SetWindowsHookEx(WH_GETMESSAGE,@msghook,HInstance,0);<br>end;<br><br>end.

接受答案了.