api HOOK 代码 ( 积分: 100 )

unit&nbsp;APIHook;<br><br>interface<br><br>uses<br>&nbsp;&nbsp;Windows,&nbsp;Classes;<br>&nbsp;&nbsp;&nbsp;<br>function&nbsp;LocateFunctionAddress(Code:&nbsp;Pointer):&nbsp;Pointer;<br>function&nbsp;RepointFunction(OldFunc,&nbsp;NewFunc:&nbsp;Pointer):&nbsp;Integer;<br><br>type&nbsp;//定义一个入口结构<br>&nbsp;&nbsp;PImage_Import_Entry&nbsp;=&nbsp;^Image_Import_Entry;<br>&nbsp;&nbsp;Image_Import_Entry&nbsp;=&nbsp;record<br>&nbsp;&nbsp;&nbsp;&nbsp;Characteristics:&nbsp;DWORD;<br>&nbsp;&nbsp;&nbsp;&nbsp;TimeDateStamp:&nbsp;DWORD;<br>&nbsp;&nbsp;&nbsp;&nbsp;MajorVersion:&nbsp;Word;<br>&nbsp;&nbsp;&nbsp;&nbsp;MinorVersion:&nbsp;Word;<br>&nbsp;&nbsp;&nbsp;&nbsp;Name:&nbsp;DWORD;<br>&nbsp;&nbsp;&nbsp;&nbsp;LookupTable:&nbsp;DWORD;<br>&nbsp;&nbsp;end;<br><br>&nbsp;&nbsp;TImportCode&nbsp;=&nbsp;packed&nbsp;record&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//定义一个跳转的结构<br>&nbsp;&nbsp;&nbsp;&nbsp;JumpInstruction:&nbsp;Word;&nbsp;//定义跳转指令jmp<br>&nbsp;&nbsp;&nbsp;&nbsp;AddressOfPointerToFunction:&nbsp;^Pointer;&nbsp;//定义要跳转到的函数<br>&nbsp;&nbsp;end;<br>&nbsp;&nbsp;PImportCode&nbsp;=&nbsp;^TImportCode;<br><br>implementation<br><br>function&nbsp;LocateFunctionAddress(Code:&nbsp;Pointer):&nbsp;Pointer;<br>var<br>&nbsp;&nbsp;func:&nbsp;PImportCode;<br>begin<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;Code;<br>&nbsp;&nbsp;if&nbsp;Code&nbsp;=&nbsp;nil&nbsp;then&nbsp;exit;<br>&nbsp;&nbsp;try<br>&nbsp;&nbsp;&nbsp;&nbsp;func&nbsp;:=&nbsp;code;<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;func.JumpInstruction&nbsp;=&nbsp;$25FF&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Result&nbsp;:=&nbsp;func.AddressOfPointerToFunction^;<br>&nbsp;&nbsp;except<br>&nbsp;&nbsp;&nbsp;&nbsp;Result&nbsp;:=&nbsp;nil;<br>&nbsp;&nbsp;end;<br>end;<br><br>function&nbsp;RepointFunction(OldFunc,&nbsp;NewFunc:&nbsp;Pointer):&nbsp;Integer;<br>var<br>&nbsp;&nbsp;IsDone:&nbsp;TList;<br>&nbsp;&nbsp;function&nbsp;RepointAddrInModule(hModule:&nbsp;THandle;&nbsp;OldFunc,&nbsp;NewFunc:&nbsp;Pointer):&nbsp;Integer;<br>&nbsp;&nbsp;var<br>&nbsp;&nbsp;&nbsp;&nbsp;Dos:&nbsp;PImageDosHeader;<br>&nbsp;&nbsp;&nbsp;&nbsp;NT:&nbsp;PImageNTHeaders;<br>&nbsp;&nbsp;&nbsp;&nbsp;ImportDesc:&nbsp;PImage_Import_Entry;<br>&nbsp;&nbsp;&nbsp;&nbsp;RVA:&nbsp;DWORD;<br>&nbsp;&nbsp;&nbsp;&nbsp;Func:&nbsp;^Pointer;<br>&nbsp;&nbsp;&nbsp;&nbsp;DLL:&nbsp;PChar;<br>&nbsp;&nbsp;&nbsp;&nbsp;f:&nbsp;Pointer;<br>&nbsp;&nbsp;&nbsp;&nbsp;written:&nbsp;DWORD;<br>&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;Result&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;&nbsp;&nbsp;Dos&nbsp;:=&nbsp;Pointer(hModule);<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;IsDone.IndexOf(Dos)&nbsp;&gt;=&nbsp;0&nbsp;then&nbsp;exit;<br>&nbsp;&nbsp;&nbsp;&nbsp;IsDone.Add(Dos);<br><br>&nbsp;&nbsp;&nbsp;&nbsp;OldFunc&nbsp;:=&nbsp;LocateFunctionAddress(OldFunc);<br><br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;IsBadReadPtr(Dos,&nbsp;SizeOf(TImageDosHeader))&nbsp;then&nbsp;exit;<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;Dos.e_magic&nbsp;&lt;&gt;&nbsp;IMAGE_DOS_SIGNATURE&nbsp;then&nbsp;exit;<br>&nbsp;&nbsp;&nbsp;&nbsp;NT&nbsp;:=&nbsp;Pointer(Integer(Dos)&nbsp;+&nbsp;dos._lfanew);<br><br>&nbsp;&nbsp;&nbsp;&nbsp;RVA&nbsp;:=&nbsp;NT^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;.VirtualAddress;<br><br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;RVA&nbsp;=&nbsp;0&nbsp;then&nbsp;exit;<br>&nbsp;&nbsp;&nbsp;&nbsp;ImportDesc&nbsp;:=&nbsp;pointer(integer(Dos)&nbsp;+&nbsp;RVA);<br>&nbsp;&nbsp;&nbsp;&nbsp;while&nbsp;(ImportDesc^.Name&nbsp;&lt;&gt;&nbsp;0)&nbsp;do<br>&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;DLL&nbsp;:=&nbsp;PChar(Integer(Dos)&nbsp;+&nbsp;ImportDesc^.Name);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;RepointAddrInModule(GetModuleHandle(DLL),&nbsp;OldFunc,&nbsp;NewFunc);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Func&nbsp;:=&nbsp;Pointer(Integer(DOS)&nbsp;+&nbsp;ImportDesc.LookupTable);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;while&nbsp;Func^&nbsp;&lt;&gt;&nbsp;nil&nbsp;do<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;f&nbsp;:=&nbsp;LocateFunctionAddress(Func^);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;f&nbsp;=&nbsp;OldFunc&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;WriteProcessMemory(GetCurrentProcess,&nbsp;Func,&nbsp;@NewFunc,&nbsp;4,&nbsp;written);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;Written&nbsp;&gt;&nbsp;0&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Inc(Result);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Inc(Func);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Inc(ImportDesc);<br>&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;end;<br><br>begin<br>&nbsp;&nbsp;IsDone&nbsp;:=&nbsp;TList.Create;<br>&nbsp;&nbsp;try<br>&nbsp;&nbsp;&nbsp;&nbsp;Result&nbsp;:=&nbsp;RepointAddrInModule(GetModuleHandle(nil),&nbsp;OldFunc,&nbsp;NewFunc);<br>&nbsp;&nbsp;finally<br>&nbsp;&nbsp;&nbsp;&nbsp;IsDone.Free;<br>&nbsp;&nbsp;end;<br>end;<br><br>end.<br><br>2<br>unit&nbsp;HookAPI;<br><br>interface<br><br>uses<br>&nbsp;&nbsp;Windows;<br><br>function&nbsp;SetHookAPI(TargetModule,&nbsp;TargetProcchar;&nbsp;NewProc:&nbsp;Pointer;&nbsp;var&nbsp;OldProc:&nbsp;Pointer):&nbsp;integer;&nbsp;&nbsp;stdcall;<br>function&nbsp;UnHookAPI(NewProc,&nbsp;OldProc:&nbsp;Pointer):&nbsp;integer;&nbsp;stdcall;<br><br>type<br>&nbsp;&nbsp;TModuleList&nbsp;=&nbsp;array&nbsp;of&nbsp;cardinal;<br><br>&nbsp;&nbsp;TImportFunction&nbsp;=&nbsp;packed&nbsp;record&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//定义一个跳转的结构<br>&nbsp;&nbsp;&nbsp;&nbsp;JumpInstruction:&nbsp;Word;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//定义跳转指令jmp<br>&nbsp;&nbsp;&nbsp;&nbsp;AddressOfPointerToFunction:&nbsp;^Pointer;&nbsp;&nbsp;//定义要跳转到的函数<br>&nbsp;&nbsp;end;<br>&nbsp;&nbsp;<br>&nbsp;&nbsp;TImageImportEntry&nbsp;=&nbsp;record&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//定义一个入口结构<br>&nbsp;&nbsp;&nbsp;&nbsp;Characteristics:&nbsp;dword;<br>&nbsp;&nbsp;&nbsp;&nbsp;TimeDateStamp:&nbsp;dword;<br>&nbsp;&nbsp;&nbsp;&nbsp;MajorVersion:&nbsp;word;<br>&nbsp;&nbsp;&nbsp;&nbsp;MinorVersion:&nbsp;word;<br>&nbsp;&nbsp;&nbsp;&nbsp;Name:&nbsp;dword;<br>&nbsp;&nbsp;&nbsp;&nbsp;LookupTable:&nbsp;dword;<br>&nbsp;&nbsp;end;<br><br>implementation<br><br>function&nbsp;GetModuleList:&nbsp;TModuleList;&nbsp;&nbsp;stdcall;<br>var<br>&nbsp;&nbsp;Module,&nbsp;Base:&nbsp;pointer;<br>&nbsp;&nbsp;ModuleCount:&nbsp;integer;<br>&nbsp;&nbsp;lpModuleName:&nbsp;array&nbsp;[0..MAX_PATH]&nbsp;of&nbsp;char;<br>&nbsp;&nbsp;MemoryBasicInformation:&nbsp;TMemoryBasicInformation;<br>begin&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//枚举模块列表&nbsp;貌似用HelpAPI弄个快照效果差不多<br>&nbsp;&nbsp;SetLength(Result,&nbsp;10);<br>&nbsp;&nbsp;ModuleCount&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;Module&nbsp;:=&nbsp;nil;<br>&nbsp;&nbsp;Base&nbsp;:=&nbsp;nil;<br>&nbsp;&nbsp;while&nbsp;VirtualQueryEx(GetCurrentProcess,&nbsp;Module,&nbsp;MemoryBasicInformation,&nbsp;SizeOf(MemoryBasicInformation))&nbsp;=&nbsp;SizeOf(MemoryBasicInformation)&nbsp;do<br>&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(MemoryBasicInformation.State&nbsp;=&nbsp;MEM_COMMIT)&nbsp;and&nbsp;(MemoryBasicInformation.AllocationBase&nbsp;&lt;&gt;&nbsp;Base)&nbsp;and&nbsp;(MemoryBasicInformation.AllocationBase&nbsp;=&nbsp;MemoryBasicInformation.BaseAddress)&nbsp;and&nbsp;(GetModuleFileName(dword(MemoryBasicInformation.AllocationBase),&nbsp;lpModuleName,&nbsp;MAX_PATH)&nbsp;&gt;&nbsp;0)&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;ModuleCount&nbsp;=&nbsp;Length(Result)&nbsp;then&nbsp;SetLength(Result,&nbsp;ModuleCount&nbsp;*&nbsp;2);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Result[ModuleCount]&nbsp;:=&nbsp;dword(MemoryBasicInformation.AllocationBase);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Inc(ModuleCount);<br>&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;Base&nbsp;:=&nbsp;MemoryBasicInformation.AllocationBase;<br>&nbsp;&nbsp;&nbsp;&nbsp;dword(Module)&nbsp;:=&nbsp;dword(Module)&nbsp;+&nbsp;MemoryBasicInformation.RegionSize;<br>&nbsp;&nbsp;end;<br>&nbsp;&nbsp;SetLength(Result,&nbsp;ModuleCount);<br>end;<br><br>function&nbsp;FunctionAddress(Code:&nbsp;Pointer):&nbsp;Pointer;stdcall;<br>begin&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//获得函数真实地址<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;Code;<br>&nbsp;&nbsp;if&nbsp;TImportFunction(Code^).JumpInstruction&nbsp;=&nbsp;$25FF&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;Result&nbsp;:=&nbsp;TImportFunction(Code^).AddressOfPointerToFunction^;<br>end;<br><br>function&nbsp;HookModules(ImageDosHeader:&nbsp;PImageDosHeader;&nbsp;TargetAddress,&nbsp;NewAddress:&nbsp;Pointer;&nbsp;var&nbsp;OldAddress:&nbsp;Pointer):integer;stdcall;<br>var<br>&nbsp;&nbsp;ImageNTHeaders&nbsp;:&nbsp;PImageNtHeaders;<br>&nbsp;&nbsp;ImageImportEntry:&nbsp;^TImageImportEntry;<br>&nbsp;&nbsp;ImportCode:&nbsp;^Pointer;<br>&nbsp;&nbsp;OldProtect:&nbsp;dword;<br>&nbsp;&nbsp;EndofImports:&nbsp;dword;<br>begin&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//修改一个模块来HookAPI<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;OldAddress&nbsp;:=&nbsp;FunctionAddress(TargetAddress);<br>&nbsp;&nbsp;<br>&nbsp;&nbsp;if&nbsp;ImageDosHeader.e_magic&nbsp;&lt;&gt;&nbsp;IMAGE_DOS_SIGNATURE&nbsp;then&nbsp;Exit;<br>&nbsp;&nbsp;ImageNTHeaders&nbsp;:=&nbsp;Pointer(integer(ImageDosHeader)&nbsp;+&nbsp;ImageDosHeader._lfanew);;<br>&nbsp;&nbsp;if&nbsp;ImageNTHeaders&nbsp;&lt;&gt;&nbsp;nil&nbsp;then<br>&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;with&nbsp;ImageNTHeaders^.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT]&nbsp;do<br>&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ImageImportEntry&nbsp;:=&nbsp;Pointer(dword(ImageDosHeader)&nbsp;+&nbsp;VirtualAddress);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;EndofImports&nbsp;:=&nbsp;VirtualAddress&nbsp;+&nbsp;Size;<br>&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;ImageImportEntry&nbsp;&lt;&gt;&nbsp;nil&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;while&nbsp;ImageImportEntry^.Name&nbsp;&lt;&gt;&nbsp;0&nbsp;do<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;ImageImportEntry^.LookUpTable&nbsp;&gt;&nbsp;EndofImports&nbsp;then&nbsp;break;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;ImageImportEntry^.LookUpTable&nbsp;&lt;&gt;&nbsp;0&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ImportCode&nbsp;:=&nbsp;Pointer(dword(ImageDosHeader)&nbsp;+&nbsp;ImageImportEntry^.LookUpTable);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;while&nbsp;ImportCode^&nbsp;&lt;&gt;&nbsp;nil&nbsp;do<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(ImportCode^&nbsp;=&nbsp;TargetAddress)&nbsp;and&nbsp;VirtualProtect(ImportCode,&nbsp;4,&nbsp;PAGE_EXECUTE_READWRITE,&nbsp;@OldProtect)&nbsp;then&nbsp;ImportCode^&nbsp;:=&nbsp;NewAddress;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Inc(ImportCode);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Inc(ImageImportEntry);<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;end;<br>end;<br><br>function&nbsp;SetHookAPI(TargetModule,&nbsp;TargetProcchar;&nbsp;NewProc:&nbsp;Pointer;&nbsp;var&nbsp;OldProc:&nbsp;Pointer):&nbsp;integer;&nbsp;&nbsp;stdcall;<br>var<br>&nbsp;ModuleLoop,i:&nbsp;integer;<br>&nbsp;Modules:&nbsp;TModuleList;<br>&nbsp;Module:&nbsp;hModule;<br>&nbsp;Target:&nbsp;pointer;<br>begin&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//实际上就是枚举模块完&nbsp;一个一个Hook<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;Module&nbsp;:=&nbsp;GetModuleHandle(pchar(TargetModule));<br>&nbsp;&nbsp;Modules&nbsp;:=&nbsp;GetModuleList;<br>&nbsp;&nbsp;if&nbsp;Module&nbsp;=&nbsp;0&nbsp;then<br>&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;Module&nbsp;:=&nbsp;LoadLibrary(pchar(TargetModule));<br>&nbsp;&nbsp;end;<br>&nbsp;&nbsp;Target&nbsp;:=&nbsp;GetProcAddress(Module,&nbsp;pchar(TargetProc));<br>&nbsp;&nbsp;if&nbsp;Target&nbsp;=&nbsp;nil&nbsp;then&nbsp;Exit;<br>&nbsp;&nbsp;i&nbsp;:=&nbsp;High(Modules);<br>&nbsp;&nbsp;for&nbsp;ModuleLoop&nbsp;:=&nbsp;0&nbsp;to&nbsp;i&nbsp;do<br>&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(GetVersion&nbsp;and&nbsp;$80000000&nbsp;=&nbsp;0)&nbsp;or&nbsp;(Modules[ModuleLoop]&nbsp;&lt;&nbsp;$80000000)&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Result&nbsp;:=&nbsp;HookModules(Pointer(Modules[ModuleLoop]),&nbsp;Target,&nbsp;NewProc,&nbsp;OldProc);<br>&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;end;<br>end;<br><br>function&nbsp;UnHookAPI(NewProc,&nbsp;OldProc:&nbsp;Pointer):&nbsp;integer;&nbsp;stdcall;<br>var<br>&nbsp;ModuleLoop:&nbsp;integer;<br>&nbsp;Modules:&nbsp;TModuleList;<br>begin&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;//反Hook一遍就是了<br>&nbsp;&nbsp;Result&nbsp;:=&nbsp;0;<br>&nbsp;&nbsp;Modules&nbsp;:=&nbsp;GetModuleList;<br>&nbsp;&nbsp;for&nbsp;ModuleLoop&nbsp;:=&nbsp;0&nbsp;to&nbsp;High(Modules)&nbsp;do<br>&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(GetVersion&nbsp;and&nbsp;$80000000&nbsp;=&nbsp;0)&nbsp;or&nbsp;(Modules[ModuleLoop]&nbsp;&lt;&nbsp;$80000000)&nbsp;then<br>&nbsp;&nbsp;&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Result&nbsp;:=&nbsp;HookModules(Pointer(Modules[ModuleLoop]),&nbsp;NewProc,&nbsp;OldProc,&nbsp;NewProc);<br>&nbsp;&nbsp;&nbsp;&nbsp;end;<br>&nbsp;&nbsp;end;<br>end;<br><br>end.<br><br>请大家一起分析一下,上面两个APIHOOK代码哪个更高效一些,哪个更简洁一些

一个陷阱式一个引入表式？？<br>各有各的优势吧

正如楼上所说<br>1是修改导入表跳转地址<br>2.是修改函数前几个字节跳转到自己的函数.<br>1.缺点是不能Hook通过GetProcAddress获得的函数地址.<br>2.缺点是通用一点的话要涉及到机器指令对齐的问题.还有别人要是也Hook的话,多次Hook处理起来很麻烦,退出次序不对的话也会崩溃.<br>不过鉴于1不能Hook全部的调用方式,我现在基本都改用方案2了

收藏了...

收藏

to:&nbsp;wr960204<br>2是不是就是所说的陷阱式<br>如何更好的解决重入的问题,网上许多贴都提过陷阱式API如果有两个以上同时调用将会有问题，不知道是什么问题，请大家断续讨论一下，如何更好的实现APIHOOK，能勾住所有函数

两种办法都有其不足的地方<br>只能根据实际情况来衡量使用哪一种

感觉还是修改引入表要稳定一些

的确是这样，但引入表有勾的到的缺点，以前有位网（哪位计不清了）友用陷阱式，把旧函数写入内存映射里了，用时直不用改回原入口，不知道这种方法如何，<br>贴上代码：<br><br>DLL的pas文件：<br>unit&nbsp;Unit4;<br><br>interface<br>uses<br>&nbsp;&nbsp;Windows,PsAPI;<br><br>type<br>&nbsp;&nbsp;mymsgboxa=function(hWnd:&nbsp;HWND;&nbsp;lpText,&nbsp;lpCaption:&nbsp;PAnsiChar;&nbsp;uType:&nbsp;UINT):&nbsp;Integer;&nbsp;stdcall;<br>&nbsp;&nbsp;Tjump=packed&nbsp;record<br>&nbsp;&nbsp;&nbsp;&nbsp;Mov:Byte;<br>&nbsp;&nbsp;&nbsp;&nbsp;addr:mymsgboxa;<br>&nbsp;&nbsp;&nbsp;&nbsp;JmpEAX:Word;<br>&nbsp;&nbsp;&nbsp;&nbsp;reservedbyte:Byte;<br>&nbsp;&nbsp;end;<br>procedure&nbsp;HookEnd;<br>procedure&nbsp;HookApi;<br>var<br>&nbsp;&nbsp;old,jmp:Tjump;//old：原函数入口结构,jmp:用来替换的结构<br>&nbsp;&nbsp;processhandle:THandle;<br>&nbsp;&nbsp;oldmsgboxaChar;//为什么用pchar?因为pointer不能直接进行加减运算，但pchar可以，这是原函数的地址<br>&nbsp;&nbsp;hookhd:THandle;<br>&nbsp;&nbsp;mi:TModuleInfo;<br>procedure&nbsp;load;<br>implementation<br>function&nbsp;mybox(hWnd:&nbsp;HWND;&nbsp;lpText,&nbsp;lpCaption:&nbsp;PAnsiChar;&nbsp;uType:&nbsp;UINT):&nbsp;Integer;&nbsp;stdcall;<br>var<br>&nbsp;&nbsp;maphd:THandle;<br>&nbsp;&nbsp;mapaddrChar;//为什么用pchar?因为pointer不能直接进行加减运算，但pchar可以<br>&nbsp;&nbsp;myfunc:mymsgboxa;<br>begin<br>&nbsp;&nbsp;maphd:=OpenFileMapping(FILE_MAP_ALL_ACCESS,true,'syfunc');<br>&nbsp;&nbsp;mapaddr:=MapViewOfFile(maphd,FILE_MAP_ALL_ACCESS,0,0,0);<br>&nbsp;&nbsp;@myfunc:=oldmsgboxa&nbsp;-&nbsp;mi.lpBaseOfDll&nbsp;+&nbsp;mapaddr;//拷贝之后的函数地址是这样算出来的<br>&nbsp;&nbsp;Result:=myfunc(hWnd,'HookAPI暂时成功了，谢谢大家','Hook',uType);<br>end;<br><br>procedure&nbsp;HookApi;<br>var<br>&nbsp;&nbsp;DllMoudle:THandle;<br>&nbsp;&nbsp;dwsizeWORD;<br>begin<br>&nbsp;&nbsp;processhandle:=GetCurrentProcess;<br>&nbsp;&nbsp;DllMoudle:=GetModuleHandle('user32.dll');<br>&nbsp;&nbsp;oldmsgboxa:=GetProcAddress(DllMoudle,'MessageBoxA');<br>&nbsp;&nbsp;if&nbsp;oldmsgboxa&lt;&gt;nil&nbsp;then<br>&nbsp;&nbsp;begin<br>&nbsp;&nbsp;&nbsp;&nbsp;GetModuleInformation(GetCurrentProcess,DllMoudle,@mi,SizeOf(tmoduleinfo));<br>&nbsp;&nbsp;&nbsp;&nbsp;jmp.Mov:=$B8;<br>&nbsp;&nbsp;&nbsp;&nbsp;jmp.addr:=@mybox;<br>&nbsp;&nbsp;&nbsp;&nbsp;jmp.JmpEAX:=$E0FF;<br>&nbsp;&nbsp;&nbsp;&nbsp;ReadProcessMemory(processhandle,oldmsgboxa,@old,8,dwsize);<br>&nbsp;&nbsp;&nbsp;&nbsp;WriteProcessMemory(processhandle,oldmsgboxa,@jmp,8,dwsize);<br>&nbsp;&nbsp;end;<br>end;<br>procedure&nbsp;HookEnd;<br>var<br>&nbsp;&nbsp;dwsizeWORD;<br>begin<br>&nbsp;&nbsp;WriteProcessMemory(processhandle,oldmsgboxa,@old,8,dwsize);<br>end;<br>function&nbsp;msghook(ncode,wparam,lparam:Integer):LRESULT;stdcall;<br>begin<br>&nbsp;&nbsp;hookapi;<br>&nbsp;&nbsp;Result:=CallNextHookEx(hookhd,ncode,wparam,lparam);<br>end;<br>procedure&nbsp;load;<br>begin<br>&nbsp;&nbsp;hookhd:=SetWindowsHookEx(WH_GETMESSAGE,@msghook,HInstance,0);<br>end;<br><br>end.<br><br>============================================================<br>Dll的dpr文件：<br>library&nbsp;Project4;<br><br>uses<br>&nbsp;&nbsp;Unit4&nbsp;in&nbsp;'Unit4.pas';<br><br>{$R&nbsp;*.res}<br>exports<br>&nbsp;&nbsp;load;<br>begin<br>end.<br>============================================================<br>EXE文件：<br>unit&nbsp;t;<br><br>interface<br><br>uses<br>&nbsp;&nbsp;Windows,&nbsp;Messages,&nbsp;SysUtils,&nbsp;Variants,&nbsp;Classes,&nbsp;Graphics,&nbsp;Controls,&nbsp;Forms,<br>&nbsp;&nbsp;Dialogs,&nbsp;StdCtrls,PsAPI;<br><br>type<br><br><br>&nbsp;&nbsp;TForm1&nbsp;=&nbsp;class(TForm)<br>&nbsp;&nbsp;&nbsp;&nbsp;Button1:&nbsp;TButton;<br>&nbsp;&nbsp;&nbsp;&nbsp;Button2:&nbsp;TButton;<br>&nbsp;&nbsp;&nbsp;&nbsp;Button3:&nbsp;TButton;<br>&nbsp;&nbsp;&nbsp;&nbsp;procedure&nbsp;Button1Click(Sender:&nbsp;TObject);<br>&nbsp;&nbsp;&nbsp;&nbsp;procedure&nbsp;Button3Click(Sender:&nbsp;TObject);<br>&nbsp;&nbsp;private<br>&nbsp;&nbsp;&nbsp;&nbsp;{&nbsp;Private&nbsp;declarations&nbsp;}<br>&nbsp;&nbsp;public<br>&nbsp;&nbsp;&nbsp;&nbsp;{&nbsp;Public&nbsp;declarations&nbsp;}<br>&nbsp;&nbsp;end;<br><br>var<br>&nbsp;&nbsp;Form1:&nbsp;TForm1;<br>procedure&nbsp;load;external&nbsp;'project4.dll';<br>implementation<br><br>{$R&nbsp;*.dfm}<br><br>procedure&nbsp;TForm1.Button1Click(Sender:&nbsp;TObject);<br>var<br>&nbsp;&nbsp;maphd,msghd:THandle;<br>&nbsp;&nbsp;msgaddr,naddrointer;<br>&nbsp;&nbsp;mdinfo:TModuleInfo;<br>begin<br>&nbsp;&nbsp;msghd:=LoadLibrary('user32.dll');<br>&nbsp;&nbsp;msgaddr:=GetProcAddress(msghd,'MessageBoxA');<br>&nbsp;&nbsp;GetModuleInformation(GetCurrentProcess,msghd,@mdinfo,SizeOf(mdinfo));<br>&nbsp;&nbsp;maphd:=CreateFileMapping($ffffffff,nil,PAGE_EXECUTE_READWRITE,0,mdinfo.SizeOfImage,'syfunc');<br>&nbsp;&nbsp;naddr:=MapViewOfFile(maphd,FILE_MAP_ALL_ACCESS,0,0,0);<br>&nbsp;&nbsp;CopyMemory(naddr,mdinfo.lpBaseOfDll,mdinfo.SizeOfImage);<br>&nbsp;&nbsp;load;<br>end;<br><br>procedure&nbsp;TForm1.Button3Click(Sender:&nbsp;TObject);<br>begin<br>MessageBoxA(0,'ffffff','fffffff',0);<br>end;<br><br>end.<br><br>大家一起看看

陷阱式比较好，不过这个代码也太那个了。

这代码确实有点，但我们在这里主要是讨论一种思路，代码的优劣暂不评论，希望有过此方面经验的大虾一起来继续讨论

to:白河悉大侠<br>能否把您写APIHOOK的经历及技巧给大家说说，讲讲两种方法的优缺点，及您是如何解决相应弊端的，<br>另外可否给小弟一份你的APIHOOK控件（源码实在不敢啬求，当然如果你愿意大家学习一下最好了）

顶一下

刚接触hook，看看