|
发表于 2016-3-17 22:22:45
|
显示全部楼层
本代码用于HOOK自己代码里的CreateFileA 和 CreateFileW。
如果你想HOOK别的进程,需要另外写DLL,比较复杂了。
#include "imageHlp.h"
#pragma comment(lib,"imagehlp.lib")
const char * dllName = "Kernel32.dll";
const char * functionName[2] = {"CreateFileA","CreateFileW"};
PROC lpOldFun[2] = {0};
PROC lpNewFun[2] = {0};
typedef HANDLE (WINAPI * lpCreateFileA)(LPCSTR,DWORD,DWORD,LPSECURITY_ATTRIBUTES,DWORD,DWORD,HANDLE);
typedef HANDLE (WINAPI * lpCreateFileW)(LPCWSTR,DWORD,DWORD,LPSECURITY_ATTRIBUTES,DWORD,DWORD,HANDLE);
HANDLE WINAPI MyCreateFileA(LPCSTR lpFileName,
DWORD dwDesiredAccess,
DWORD dwShareMode,
LPSECURITY_ATTRIBUTES lpSecurityAttributes,
DWORD dwCreationDisposition,
DWORD dwFlagsAndAttributes,
HANDLE hTemplateFile);
HANDLE WINAPI MyCreateFileW(LPCWSTR lpFileName,
DWORD dwDesiredAccess,
DWORD dwShareMode,
LPSECURITY_ATTRIBUTES lpSecurityAttributes,
DWORD dwCreationDisposition,
DWORD dwFlagsAndAttributes,
HANDLE hTemplateFile);
HANDLE WINAPI MyCreateFileA(LPCSTR lpFileName,
DWORD dwDesiredAccess,
DWORD dwShareMode,
LPSECURITY_ATTRIBUTES lpSecurityAttributes,
DWORD dwCreationDisposition,
DWORD dwFlagsAndAttributes,
HANDLE hTemplateFile)
{
HANDLE hFile = INVALID_HANDLE_VALUE;
//获得打开文件名
MessageBox(NULL,lpFileName,"the open file name",MB_OK);
if(lpOldFun[0] != NULL)
{
//调用系统的CreateFileA
hFile = ((lpCreateFileA)lpOldFun[0])(lpFileName,
dwDesiredAccess,
dwShareMode,
lpSecurityAttributes,
dwCreationDisposition,
dwFlagsAndAttributes,
hTemplateFile);
}
return hFile;
}
HANDLE WINAPI MyCreateFileW(LPCWSTR lpFileName,
DWORD dwDesiredAccess,
DWORD dwShareMode,
LPSECURITY_ATTRIBUTES lpSecurityAttributes,
DWORD dwCreationDisposition,
DWORD dwFlagsAndAttributes,
HANDLE hTemplateFile)
{
HANDLE hFile = INVALID_HANDLE_VALUE;
if(lpOldFun[1] != NULL)
{
hFile = ((lpCreateFileW)lpOldFun[1])(lpFileName,
dwDesiredAccess,
dwShareMode,
lpSecurityAttributes,
dwCreationDisposition,
dwFlagsAndAttributes,
hTemplateFile);
}
return hFile;
}
void GetFunctionAddress()
{
HMODULE kernel32 = LoadLibrary(dllName);
for(int i = 0 ; i < 2 ; i ++)
{
lpOldFun[i] = GetProcAddress(kernel32,functionName[i]);
}
lpNewFun[0] = (PROC)MyCreateFileA;
lpNewFun[1] = (PROC)MyCreateFileW;
}
void HookApi()
{
HINSTANCE hInst = AfxGetInstanceHandle();
ULONG ulSize;
PIMAGE_IMPORT_DESCRIPTOR lpImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)
ImageDirectoryEntryToData(hInst,TRUE,IMAGE_DIRECTORY_ENTRY_IMPORT,&ulSize);
if(lpImportDesc == NULL)
return;
for(; lpImportDesc->Name; lpImportDesc ++)
{
LPSTR szModName = (char *)hInst + lpImportDesc->Name;
if(_stricmp(szModName,dllName) == 0)
{
break;
}
}
if(lpImportDesc->Name == 0)
return;
PIMAGE_THUNK_DATA lpThunk = (PIMAGE_THUNK_DATA)((char *)hInst + lpImportDesc->FirstThunk);
for(; lpThunk->u1.Function ; lpThunk ++)
{
PROC * lppFun = (PROC *) &lpThunk->u1.Function;
if(* lppFun == lpOldFun[0])
{
HANDLE hProcess = GetCurrentProcess();
BOOL blnRet = WriteProcessMemory(hProcess,lppFun,&lpNewFun[0],sizeof(PROC),NULL);
}
if(* lppFun == lpOldFun[1])
{
HANDLE hProcess = GetCurrentProcess();
BOOL blnRet = WriteProcessMemory(hProcess,lppFun,&lpNewFun[1],sizeof(PROC),NULL);
}
}
}
使用方法及测试代码:
GetFunctionAddress();
HookApi();
CFileDialog dlg(TRUE);
dlg.DoModal();
CString fileName = dlg.GetPathName();
HANDLE hFile = CreateFile(fileName,GENERIC_READ|GENERIC_WRITE,0,NULL,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,NULL);
if(hFile != INVALID_HANDLE_VALUE)
{
CloseHandle(hFile);
::MessageBoxA(NULL,"succeed to open file!","",MB_OK);
} |
|