200分,立马给分!关于hook的源程序,请大虾来调试一下? (0分)

  • 主题发起人 主题发起人 君忆
  • 开始时间 开始时间

君忆

Unregistered / Unconfirmed
GUEST, unregistred user!
[:(]转载:从此论谈!但不能通过!!
************************************
library mydll;
uses
SysUtils,
windows,
messages,
Classes,
hookproc in 'hookproc.pas';

{$R *.RES}
exports
setkeyhook,endkeyhook;
begin
nexthookproc:=0;
procsaveexit:=exitproc;
exitproc:=@keyhookexit;0
end.
*********************************
unit hookproc;
interface
uses
Windows, Messages, SysUtils, Controls, StdCtrls;
var
nexthookproc:hhook;
procsaveexit:pointer;
function keyboardhook(icode:integer;wparam:wparam;lparam:lparam):lresult;stdcall;export;
function setkeyhook:bool;export;//加载钩子
function endkeyhook:bool;export;//卸载钩子
procedure keyhookexit;far;
const
afilename='c:/debug.txt';//将键盘输入动作写入文件中
var
debugfile:textfile;
implementation
function keyboardhookhandler(icode:integer;wparam:wparam;
lparam:lparam):lresult;stdcall;export;
begin
if icode<0 then
begin
result:=callnexthookex(nexthookproc,icode,wparam,lparam);
exit;
end;
assignfile(debugfile,afilename);
append(debugfile);
if getkeystate(vk_return)<0 then
begin
writeln(debugfile,'');
write(debugfile,char(wparam));
end
else
write(debugfile,char(wparam));
closefile(debugfile);
result:=0;
end;
function endkeyhook:bool;export;
begin
if nexthookproc<>0 then
begin
unhookwindowshookex(nexthookproc);
nexthookproc:=0;
messagebeep(0);
end;
result:=nexthookproc=0;
end;
procedure keyhookexit;far;
begin
if nexthookproc<>0 then endkeyhook;
exitproc:=procsaveexit;
end;
end.
 
钩子里的所有变量必须是局部变量,全部变量'c:/debug.txt'一定要放在共享内存中!
请参照如下改写你的代码,或者我主页上有个类似的源代码http://wenjinshan.yeah.net

unit UnitDllMain;

interface

uses windows,Unitwjshook,Sysutils,dialogs;

const
MappingFileName = '_MyCommDLL';

type
TShareMem = packed record
ComPortFile:array[0..255] of char;
FileHandle:THandle;
DatToWriteFile:array[0..255] of char;
DatToReadFile:array[0..255] of char;
MessageHook: HHOOK;
end;
PShareMem = ^TShareMem;

procedure StartHook(FileBeSpy,readfile,writefile:pchar); stdcall;
procedure StopHook; stdcall;
procedure DllEntry(nReason : integer);

implementation

var
pShMem : PShareMem;
hMappingFile : THandle;
hook:array[0..3]of HookStruct;
FirstProcess:boolean;

function NewCreateFileA(lpFileName: PChar;dwDesiredAccess: Integer;dwShareMode: Integer;
lpSecurityAttributes: PSecurityAttributes;dwCreationDisposition: DWORD;dwFlagsAndAttributes: DWORD;
hTemplateFile: THandle): THandle;stdcall;
type
TCreateFileA=function(lpFileName: PChar;dwDesiredAccess: Integer;dwShareMode: Integer;
lpSecurityAttributes: PSecurityAttributes;dwCreationDisposition: DWORD;dwFlagsAndAttributes: DWORD;
hTemplateFile: THandle): THandle;stdcall;
begin
result:=TCreateFileA(hook[0].OldFunction)(lpFileName,dwDesiredAccess,dwShareMode,
lpSecurityAttributes,dwCreationDisposition,dwFlagsAndAttributes,
hTemplateFile);
if stricomp(lpFileName,pShMem^.ComPortFile)=0 then
begin
pShMem^.FileHandle:=result;
end;
end;

procedure SaveForWriteFile(const s;bytes:dword);
var
h:integer;
begin
if bytes=0 then exit;
if fileexists(pShMem^.DatToWriteFile) then
begin
h:=fileopen(pShMem^.DatToWriteFile,fmOpenWrite);
fileseek(h,0,2);
end
else h:=filecreate(pShMem^.DatToWriteFile);
if h=-1 then exit;
FileWrite(h,s,bytes);
FileClose(h);
end;

function NewWriteFile(hFile: THandle;const Buffer;nNumberOfBytesToWrite: DWORD;
var lpNumberOfBytesWritten: DWORD;lpOverlapped: POverlapped): BOOL;stdcall;
type
TWriteFile=function(hFile: THandle;const Buffer;nNumberOfBytesToWrite: DWORD;
var lpNumberOfBytesWritten: DWORD;lpOverlapped: POverlapped): BOOL;stdcall;
begin
result:=TWriteFile(hook[1].OldFunction)(hFile,Buffer,nNumberOfBytesToWrite,lpNumberOfBytesWritten,lpOverlapped);
if hFile=pShMem^.FileHandle then
SaveForWriteFile(buffer,nNumberOfBytesToWrite); //???? lpNumberOfBytesWritten);
end;

procedure SaveForReadFile(const s;bytes:dword);
var
h:integer;
begin
if bytes=0 then exit;
if fileexists(pShMem^.DatToReadFile) then
begin
h:=fileopen(pShMem^.DatToReadFile,fmOpenWrite);
fileseek(h,0,2);
end
else h:=filecreate(pShMem^.DatToReadFile);
if h=-1 then exit;
FileWrite(h,s,bytes);
FileClose(h);
end;

function NewReadFile(hFile: THandle;var Buffer;nNumberOfBytesToRead: DWORD;
var lpNumberOfBytesRead: DWORD;lpOverlapped: POverlapped): BOOL;stdcall;
type
TReadFile=function(hFile: THandle;var Buffer;nNumberOfBytesToRead: DWORD;
var lpNumberOfBytesRead: DWORD;lpOverlapped: POverlapped): BOOL;stdcall;
begin
result:=TReadFile(hook[2].OldFunction)(hFile,Buffer,nNumberOfBytesToRead,lpNumberOfBytesRead,lpOverlapped);
if hFile=pShMem^.FileHandle then
SaveForReadFile(buffer,lpNumberOfBytesRead);
end;

function NewCloseHandle(hObject:THandle):BOOL;stdcall;
type
TCloseHandle=function(hObject:THandle):BOOL;stdcall;
begin
if (pShMem^.FileHandle=hObject)and(hObject<>INVALID_HANDLE_VALUE) then
begin
pShMem^.FileHandle:=INVALID_HANDLE_VALUE;
end;
result:=TCloseHandle(hook[3].OldFunction)(hObject);
end;

function GetMsgProc(iCode: Integer; wParam: WPARAM; lParam: LPARAM): LRESULT; stdcall;export;
begin
Result := CallNextHookEx(pShmem^.MessageHook, iCode, wParam, lParam);
end;

procedure StartHook(FileBeSpy,readfile,writefile:pchar); stdcall;
begin
strlcopy(pShMem^.DatToWriteFile,writefile,255);
strlcopy(pShMem^.DatToReadFile,readfile,255);
strlcopy(pShMem^.ComPortFile,FileBeSpy,255);
pShmem^.MessageHook:=SetWindowsHookEx(WH_GETMESSAGE, GetMsgProc, HInstance, 0);
end;

procedure StopHook; stdcall;
begin
if pShmem^.MessageHook=0 then exit;
UnhookWindowsHookEx(pShmem^.MessageHook);
pShmem^.MessageHook:=0;
end;

procedure DllEntry(nReason : integer);
begin
case nReason Of
DLL_PROCESS_ATTACH:
begin
hMappingFile := OpenFileMapping(FILE_MAP_WRITE,False,MappingFileName);
if hMappingFile=0 then
begin
hMappingFile := CreateFileMapping($FFFFFFFF,nil,PAGE_READWRITE,0,SizeOf(TShareMem),MappingFileName);
FirstProcess:=true;
end
else FirstProcess:=false;
if hMappingFile=0 then Exception.Create('不能建立共享内存!');

pShMem := MapViewOfFile(hMappingFile,FILE_MAP_WRITE or FILE_MAP_READ,0,0,0);
if pShMem = nil then
begin
CloseHandle(hMappingFile);
Exception.Create('不能映射共享内存!');
end;
if FirstProcess then
begin
pShmem^.MessageHook:=0;
pShMem^.FileHandle:=INVALID_HANDLE_VALUE;
end;
//注意:getprocaddress(getmodulehandle('kernel32'),'CreateFileA')<>@CreateFileA
//虽然它们都指向Kernel32的CreateFileA的代码,在本例中也可以用getprocaddress...,但必须注意大小写
hook[0].OldFunction:=FinalFunctionAddress(@CreateFileA);
hook[0].NewFunction:=FinalFunctionAddress(@NewCreateFileA);
HookAPIFunction(hook[0]);

hook[1].OldFunction:=FinalFunctionAddress(@WriteFile);
hook[1].NewFunction:=FinalFunctionAddress(@NewWriteFile);
HookAPIFunction(hook[1]);

hook[2].OldFunction:=FinalFunctionAddress(@ReadFile);
hook[2].NewFunction:=FinalFunctionAddress(@NewReadFile);
HookAPIFunction(hook[2]);

hook[3].OldFunction:=FinalFunctionAddress(@CloseHandle);
hook[3].NewFunction:=FinalFunctionAddress(@NewCloseHandle);
HookAPIFunction(hook[3]);
end;
DLL_PROCESS_DETACH:
begin
UnHookAPIFunction(hook[0]);
UnHookAPIFunction(hook[1]);
UnHookAPIFunction(hook[2]);
UnHookAPIFunction(hook[3]);
UnMapViewOfFile(pShMem);
CloseHandle(hMappingFile);
end;
end;
end;

end.
 
废话连片
 
http://wenjinshan.yeah.net
打不开。
 
http://wenjinshan.yeah.net可以打开啊,你试试:
http://go6.163.com/wenjinshan/
http://wenjinshan.51.net
 
你的程序好像是那本书上来的,我记得看过,应该不会有问题,
当然,我灭有仔细看你的程序啦。
如果是钩子本身的问题。你可以到我的主页看我写过的二篇文章
suncw.boy.net.cn
suncw.y365.com
 
后退
顶部