自写Api过r3的Api函数hook

这里验证的环境是win7 64位和win10 64位

首先是64位程序，这里由于win7和win10的调用号不同，需要根据所使用的系统修改相应的调用号，顺带说明一下win64的vs程序是不支持内联汇编，这里是我自己下载的intel的parallel studio使得vs支持了内联汇编。

#include

/*---------------------------------------------------------findwindows--------------------------------------*/
#pragma pack(1)  
typedef struct _UNICODE_STRING {
	USHORT Length;
	USHORT MaximumLength;
	PWSTR  Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
#pragma pack() 

typedef VOID(__stdcall *PRtlInitUnicodeString)(IN OUT PUNICODE_STRING  DestinationString,
	IN PCWSTR  SourceString);
PRtlInitUnicodeString  RtlInitUnicodeString = (PRtlInitUnicodeString)GetProcAddress(GetModuleHandle("ntdll.dll"), "RtlInitUnicodeString");

__declspec(naked)  HWND __stdcall PNtUserFindWindowEx(ULONG hwndParent, ULONG hwndChild, PUNICODE_STRING pstrClassName, PUNICODE_STRING pstrWindowName, ULONG dwType) {
	__asm {
		mov r10, rcx
		mov eax, 0x106f//win7    0x106e 
		_EMIT 0x0F
		_EMIT 0x05
		ret
	}
}

int __stdcall main() {

	UNICODE_STRING pu_className, pu_Caption;
	memset(&pu_className, 0, sizeof(UNICODE_STRING));
	RtlInitUnicodeString(&pu_Caption, L"计算器");
	HWND fw = PNtUserFindWindowEx(0, 0, &pu_className, &pu_Caption, 0);
	SetWindowPos(fw, NULL, 100, 100, 300, 400, 1);


	system("pause");
	return 0;
}

接着是32位程序，这里的32位程序调用的是sysWow64，sysWow64做了相应的转化，使得32位程序能够调用到正确的Api函数。

#include

#pragma pack(1)  
typedef struct _UNICODE_STRING {
	USHORT Length;
	USHORT MaximumLength;
	PWSTR  Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
#pragma pack() 

typedef VOID(__stdcall *PRtlInitUnicodeString)(IN OUT PUNICODE_STRING  DestinationString,
	IN PCWSTR  SourceString);
PRtlInitUnicodeString  RtlInitUnicodeString = (PRtlInitUnicodeString)GetProcAddress(GetModuleHandle("ntdll.dll"), "RtlInitUnicodeString");

__declspec(naked)  HWND __stdcall PNtUserFindWindowEx(ULONG hwndParent, ULONG hwndChild, PUNICODE_STRING pstrClassName, PUNICODE_STRING pstrWindowName, ULONG dwType) {
	__asm {
		//win 10 0x106f
		mov eax,0x106e   
		mov ecx,0x0
		lea edx,dword ptr ss:[esp+0x4]
		call fs:[0xc0]
		add esp,0x4    //win10需要干掉它
		retn 0x14
	}
}


int  main(){
	UNICODE_STRING pu_className, pu_Caption;
	memset(&pu_className, 0, sizeof(UNICODE_STRING));
	RtlInitUnicodeString(&pu_Caption, L"计算器");
	HWND fw= PNtUserFindWindowEx(0, 0,&pu_className,&pu_Caption,0);
	SetWindowPos(fw, NULL, 100, 100,300, 400, 1);
	return 0;
}