CApiHook__Api钩子类

见过网上有很多ApiHook的类,但是都不尽入人意,要么就是写的不够好不够完善,要么就是跑不起来.

用别人写的代码总是有种不安心,所以自己就花了一晚上写了CApiHook类.已经尽量确保自己写的类是非常完善的.

 

//编写和测试环境: Microsoft Visual Studio 2015 Enterprise RC / Microsoft Windows 7 Ultimate x86

 

 

 1 #pragma once

 2 

 3 #ifndef CAPIHOOK_H

 4 #define CAPIHOOK_H

 5 

 6 #include <cstdio>

 7 #include <windows.h>

 8 

 9 using namespace std;

10 

11 class CApiHook

12 {

13 protected:

14     bool status;            // the status of Hook

15     HMODULE hModule;        // the dll moudle handle of original function

16     LPVOID lpOldProcAddr;    // the address of original function

17     LPVOID lpNewProcAddr;    // the address of Hook function

18     BYTE bOldByte[5];        // the raw data of the original address

19     BYTE bNewByte[5];        // the new data of the original address / the key jump statement of structure

20     LPVOID lpBaseAddr;        // the base address of the original function

21 

22     bool WriteOldProcAddrByte(LPCVOID lpBuffer);

23 

24 public:

25     CApiHook();

26     ~CApiHook();

27 

28     bool Install(PSTR szModuleName, PSTR szProcName, FARPROC pNewProc);

29     bool Suspend();

30     bool Resume();

31     bool Uninstall();

32 

33     LPCVOID GetOldProcAddr();

34 

35 };

36 

37 #endif    //    define CAPIHOOK_H

CApiHook.h

 

 

  1 #include "CApiHook.h"

  2 

  3 CApiHook::CApiHook()

  4 {

  5     memset(this, 0, sizeof(CApiHook));

  6 }

  7 

  8 CApiHook::~CApiHook()

  9 {

 10     if (status == true)

 11         Uninstall();

 12 }

 13 

 14 bool CApiHook::Install(PSTR szModuleName, PSTR szProcName, FARPROC pNewProc)

 15 {

 16     if (status == true)

 17         return false;

 18 

 19     hModule = GetModuleHandleA(szModuleName);

 20     if (hModule == NULL)

 21     {

 22         hModule = LoadLibraryA(szModuleName);

 23         if (hModule == NULL)

 24             return false;

 25     }

 26 

 27     lpNewProcAddr = (LPVOID)pNewProc;

 28     lpOldProcAddr = (LPVOID)GetProcAddress(hModule, szProcName);

 29     if (lpOldProcAddr == NULL)

 30     {

 31         FreeLibrary(hModule);

 32         return false;

 33     }

 34 

 35     RtlMoveMemory(bOldByte, lpOldProcAddr, 5);

 36     bNewByte[0] = 0xE9;

 37     *((PDWORD)(&(bNewByte[1]))) = (DWORD)lpNewProcAddr - (DWORD)lpOldProcAddr - 5;

 38 

 39     MEMORY_BASIC_INFORMATION mbi;

 40     if (VirtualQueryEx(GetCurrentProcess(), lpOldProcAddr, &mbi, sizeof(mbi)) == 0)

 41     {

 42         FreeLibrary(hModule);

 43         return false;

 44     }

 45 

 46     lpBaseAddr = mbi.BaseAddress;

 47 

 48     if (WriteOldProcAddrByte(bNewByte) == false)

 49     {

 50         FreeLibrary(hModule);

 51         return false;

 52     }

 53 

 54     status = true;

 55     return true;

 56 }

 57 

 58 bool CApiHook::Suspend()

 59 {

 60     if (status != true)

 61         return false;

 62 

 63     if (WriteOldProcAddrByte(bOldByte) == false)

 64         return false;

 65 

 66     return true;

 67 }

 68 

 69 bool CApiHook::Resume()

 70 {

 71     if (status != true)

 72         return false;

 73 

 74     if (WriteOldProcAddrByte(bNewByte) == false)

 75         return false;

 76 

 77     return true;

 78 }

 79 

 80 bool CApiHook::Uninstall()

 81 {

 82     if (status != true)

 83         return false;

 84 

 85     if (WriteOldProcAddrByte(bOldByte) == false)

 86         return false;

 87 

 88     if (hModule != NULL)

 89         FreeLibrary(hModule);

 90 

 91     memset(this, 0, sizeof(CApiHook));

 92 

 93     return true;

 94 }

 95 

 96 LPCVOID CApiHook::GetOldProcAddr()

 97 {

 98     if (status != true)

 99         return NULL;

100 

101     return lpOldProcAddr;

102 }

103 

104 bool CApiHook::WriteOldProcAddrByte(LPCVOID lpBuffer)

105 {

106     DWORD dwOldProtect;

107     if (VirtualProtectEx(GetCurrentProcess(), lpBaseAddr, 5, PAGE_READWRITE, &dwOldProtect) == 0)

108         return false;

109 

110     DWORD dwWriteByte;

111     if (WriteProcessMemory(GetCurrentProcess(), (LPVOID)lpOldProcAddr, lpBuffer, 5, &dwWriteByte) == 0)

112         return false;

113 

114     if (VirtualProtectEx(GetCurrentProcess(), lpBaseAddr, 5, dwOldProtect, &dwOldProtect) == 0)

115         return false;

116 

117     return true;

118 }

CApiHook.cpp

 

 

 1 #include <cstdio>

 2 #include <windows.h>

 3 

 4 #include "CApiHook.h"

 5 

 6 using namespace std;

 7 

 8 CApiHook HookMessageBoxA;

 9 

10 typedef int (WINAPI* pMessageBoxA)(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType);

11 

12 int WINAPI NewMessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType)

13 {

14     const int MAXSTRLEN = 65535;

15 

16     if (strlen(lpText) >= MAXSTRLEN || strlen(lpCaption) >= MAXSTRLEN)

17         return 0;

18 

19     char strText[MAXSTRLEN] = "";

20     strcpy(strText, lpText);

21     strcat(strText, "[Hijact]");

22 

23     char strCaption[MAXSTRLEN] = "";

24     strcpy(strCaption, lpCaption);

25     strcat(strCaption, "[Hijact]");

26 

27     HookMessageBoxA.Suspend();

28 

29     int ret = MessageBoxA(NULL, strText, strCaption, MB_OK | MB_ICONINFORMATION);

30 

31     HookMessageBoxA.Resume();

32 

33     return ret;

34 }

35 

36 int main()

37 {

38     MessageBoxA(NULL, "1Text", "1Caption", MB_OK | MB_ICONINFORMATION);

39 

40     HookMessageBoxA.Install("User32.dll", "MessageBoxA", (FARPROC)NewMessageBoxA);

41 

42     MessageBoxA(NULL, "2Text", "2Caption", MB_OK | MB_ICONINFORMATION);

43 

44     HookMessageBoxA.Uninstall();

45 

46     MessageBoxA(NULL, "3Text", "3Caption", MB_OK | MB_ICONINFORMATION);

47 

48     printf("Hello World\n");

49 

50     system("pause");

51     return 0;

52 }

main.cpp